diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index fefc1b9dde41..fa27af1fec20 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -120,6 +120,8 @@ add_library(bitcoin_consensus STATIC EXCLUDE_FROM_ALL
   script/interpreter.cpp
   script/script.cpp
   script/script_error.cpp
+  script/valtype_stack.cpp
+  script/val64.cpp
   uint256.cpp
 )
 target_link_libraries(bitcoin_consensus
diff --git a/src/bench/CMakeLists.txt b/src/bench/CMakeLists.txt
index 16eb29250f50..367e758b0646 100644
--- a/src/bench/CMakeLists.txt
+++ b/src/bench/CMakeLists.txt
@@ -23,6 +23,7 @@ add_executable(bench_bitcoin
   disconnected_transactions.cpp
   duplicate_inputs.cpp
   ellswift.cpp
+  evalscript.cpp
   examples.cpp
   gcs_filter.cpp
   hashpadding.cpp
@@ -34,6 +35,7 @@ add_executable(bench_bitcoin
   mempool_eviction.cpp
   mempool_stress.cpp
   merkle_root.cpp
+  micro.cpp
   parse_hex.cpp
   peer_eviction.cpp
   poly1305.cpp
@@ -48,10 +50,25 @@ add_executable(bench_bitcoin
   streams_findbyte.cpp
   strencodings.cpp
   util_time.cpp
+  val64.cpp
   verify_script.cpp
   xor.cpp
 )
 
+add_executable(bench_varops
+  bench_varops.cpp
+  bench.cpp
+  nanobench.cpp
+)
+
+target_link_libraries(bench_varops
+  core_interface
+  test_util
+  bitcoin_node
+  secp256k1
+  Boost::headers
+)
+
 include(TargetDataSources)
 target_raw_data_sources(bench_bitcoin NAMESPACE benchmark::data
   data/block413567.raw
@@ -61,6 +78,7 @@ target_link_libraries(bench_bitcoin
   core_interface
   test_util
   bitcoin_node
+  secp256k1
   Boost::headers
 )
 
diff --git a/src/bench/bench_varops.cpp b/src/bench/bench_varops.cpp
new file mode 100644
index 000000000000..299616fdb1e3
--- /dev/null
+++ b/src/bench/bench_varops.cpp
@@ -0,0 +1,1072 @@
+// Copyright (c) 2025 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <bench/nanobench.h>
+#include <consensus/consensus.h>
+#include <script/interpreter.h>
+#include <script/val64.h>
+#include <common/args.h>
+#include <key.h>
+#include <script/valtype_stack.h>
+#include <crypto/sha256.h>
+#include <fstream>
+#include <util/translation.h>
+#include <util/strencodings.h>
+#include <util/string.h>
+#include <sstream>
+#include <cstdio>
+#include <iostream>
+
+const TranslateFn G_TRANSLATION_FUN{nullptr};
+
+std::set<opcodetype> SELECTED_OPCODES;
+constexpr uint64_t MAX_BLOCK_WEIGHT_UINT64 = MAX_BLOCK_WEIGHT;
+constexpr uint64_t VAROPS_BUDGET_PER_BYTE_UINT64 = VAROPS_BUDGET_PER_BYTE;
+constexpr uint64_t TOTAL_VAROPS_BUDGET = MAX_BLOCK_WEIGHT_UINT64 * VAROPS_BUDGET_PER_BYTE_UINT64;
+bool SILENT_MODE = false;
+std::string OUTPUT_FILE;
+
+const std::set<opcodetype> GSR_ONLY_OPCODES = {
+    OP_CAT, OP_SUBSTR, OP_LEFT, OP_RIGHT, OP_INVERT,
+    OP_AND, OP_OR, OP_XOR, OP_2MUL, OP_2DIV,
+    OP_MUL, OP_DIV, OP_MOD, OP_LSHIFT, OP_RSHIFT
+};
+
+namespace Timing {
+    int EPOCHS = 5;
+    constexpr int EPOCH_ITERATIONS = 1;
+    constexpr int SCHNORR_EPOCHS = 5;
+    constexpr int SCHNORR_EPOCH_ITERATIONS = 1000;
+}
+
+constexpr int SIGNATURES_PER_BLOCK = 80000;
+
+
+enum class ValuePattern {
+    STANDARD,
+    IDENTICAL,
+    ZEROS,
+    MAX_VALUE
+};
+
+struct StackTemplate {
+    std::string name;
+    uint64_t size;
+    int count;
+    ValuePattern pattern;
+};
+
+struct ScriptTemplate {
+    std::string name;
+    std::vector<opcodetype> opcodes;
+    std::string sequence_name;
+
+    ScriptTemplate(std::string n, std::vector<opcodetype> o, std::string s)
+        : name(std::move(n)), opcodes(std::move(o)), sequence_name(std::move(s)) {}
+};
+
+struct BenchTestCase {
+    std::string name;
+    ValtypeStack stack;
+    CScript script;
+    uint64_t varops_consumed{0};
+    bool is_gsr_only{false};
+};
+
+struct BenchResult {
+    std::string name;
+    double median_sec;
+    uint64_t varops_consumed;
+    double per_varop_ns;
+    bool is_gsr_only{false};
+};
+
+
+static const ankerl::nanobench::Result* FindResult(const ankerl::nanobench::Bench& benches,
+                                                   const std::string& name)
+{
+    for (auto& r : benches.results()) {
+        if (r.config().mBenchmarkName == name)
+            return &r;
+    }
+    return nullptr;
+}
+
+static ValtypeStack InitStack(
+    uint64_t size,
+    int count,
+    ValuePattern pattern)
+{
+    ValtypeStack stack;
+    uint8_t value1 = 0;
+    uint8_t value2 = 0;
+
+    switch (pattern) {
+    case ValuePattern::STANDARD:
+        value1 = 1; value2 = 2; break;
+    case ValuePattern::IDENTICAL:
+        value1 = value2 = 1; break;
+    case ValuePattern::ZEROS:
+        value1 = value2 = 0; break;
+    case ValuePattern::MAX_VALUE:
+        value1 = value2 = 0xFF; break;
+    }
+
+    stack.push_back(std::vector<unsigned char>(size, value1));
+    for (int i = 1; i < count; i++) {
+        stack.push_back(std::vector<unsigned char>(size, value2));
+    }
+    return stack;
+}
+
+static CScript CreateScript(const std::vector<opcodetype>& opcodes) {
+    CScript script;
+    while (script.size() < MAX_BLOCK_WEIGHT) {
+        for (const auto& opcode : opcodes) {
+            script << opcode;
+            if (script.size() >= MAX_BLOCK_WEIGHT) break;
+        }
+    }
+    return script;
+}
+
+std::string GetSequenceName(const std::vector<opcodetype>& opcodes) {
+    std::string name;
+    for (const auto& opcode : opcodes) {
+      auto opname = GetOpName(opcode);
+      // remove OP_ prefix
+      if (opname.starts_with("OP_")) {
+        opname = opname.substr(3);
+      }
+      name += opname + "_";
+    }
+    name.pop_back();
+    return name;
+  }
+
+static bool ContainsGsrOnlyOpcode(const std::vector<opcodetype>& opcodes) {
+    for (const auto& opcode : opcodes) {
+        if (GSR_ONLY_OPCODES.contains(opcode)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+static bool IsGsrOnlySize(uint64_t size) {
+    return size > MAX_SCRIPT_ELEMENT_SIZE;
+}
+
+static bool IsGsrOnly(const std::vector<opcodetype>& opcodes, uint64_t stack_size) {
+    return ContainsGsrOnlyOpcode(opcodes) || IsGsrOnlySize(stack_size);
+}
+
+
+std::vector<StackTemplate> GetStackTemplates() {
+    return {
+        {"1Bx2", 1, 2, ValuePattern::MAX_VALUE},
+        {"10Bx2", 10, 2, ValuePattern::MAX_VALUE},
+        {"100Bx2", 100, 2, ValuePattern::MAX_VALUE},
+        {"520Bx2", 520, 2, ValuePattern::MAX_VALUE},
+        {"1KBx2", 1000, 2, ValuePattern::MAX_VALUE},
+        {"10KBx2", 10000, 2, ValuePattern::MAX_VALUE},
+        {"100KBx2", 100000, 2, ValuePattern::MAX_VALUE},
+        {"1MBx2", 1000000, 2, ValuePattern::MAX_VALUE},
+        {"2MBx2", 2000000, 2, ValuePattern::MAX_VALUE},
+        {"200Bx32k", 200, MAX_TAPSCRIPT_V2_STACK_SIZE - 10, ValuePattern::MAX_VALUE}
+    };
+}
+
+inline bool ShouldSkipCase(const std::string& opname, const std::string& stack_name) {
+    static const std::map<std::string, std::vector<std::string>> size_limited_operations = {
+        {"MUL", {"1MBx2", "2MBx2", "4MBx2"}},
+        {"DIV", {"1MBx2", "2MBx2", "4MBx2"}},
+        {"RIPEMD160", {"1KBx2", "10KBx2", "100KBx2", "1MBx2", "2MBx2", "4MBx2"}},
+        {"SHA1", {"1KBx2", "10KBx2", "100KBx2", "1MBx2", "2MBx2", "4MBx2"}},
+        {"OVER", {"2MBx2", "4MBx2"}},
+        {"ROT", {"2MBx2", "4MBx2"}},
+        {"2ROT", {"2MBx2", "4MBx2"}},
+        {"2OVER", {"2MBx2", "4MBx2"}},
+        {"2SWAP", {"2MBx2", "4MBx2"}}
+    };
+
+    for (const auto& [op, limited_stacks] : size_limited_operations) {
+        if (opname.find(op) != std::string::npos) {
+            for (const auto& limited_stack : limited_stacks) {
+                if (stack_name == limited_stack) return true;
+            }
+        }
+    }
+    return false;
+}
+
+std::vector<std::vector<opcodetype>> GetOpcodes(opcodetype opcode) {
+    switch (opcode) {
+        // (1 in -> 1 out)
+        case OP_RIPEMD160:
+        case OP_SHA1:
+        case OP_SHA256:
+        case OP_HASH160:
+        case OP_HASH256:
+        case OP_NOT:
+        case OP_1ADD:
+        case OP_1SUB:
+        case OP_ABS:
+        case OP_NEGATE:
+        case OP_0NOTEQUAL:
+        case OP_2MUL:
+        case OP_2DIV:
+            return {{opcode, OP_DROP, OP_DUP}, {OP_3DUP, opcode, OP_DROP, opcode, OP_DROP, opcode, OP_DROP}};
+
+        // (2 in -> 1 out)
+        case OP_AND:
+        case OP_OR:
+        case OP_XOR:
+        case OP_EQUAL:
+        case OP_ADD:
+        case OP_SUB:
+        case OP_MUL:
+        case OP_DIV:
+        case OP_BOOLAND:
+        case OP_BOOLOR:
+        case OP_NUMEQUAL:
+        case OP_NUMNOTEQUAL:
+        case OP_LESSTHAN:
+        case OP_GREATERTHAN:
+        case OP_LESSTHANOREQUAL:
+        case OP_GREATERTHANOREQUAL:
+        case OP_MIN:
+        case OP_MAX:
+        case OP_LSHIFT:
+        case OP_RSHIFT:
+        case OP_LEFT:
+        case OP_RIGHT:
+            return {{OP_DUP, opcode, OP_DROP, OP_DUP}};
+
+        case OP_MOD:
+        case OP_CAT:
+            return {{OP_DUP, opcode, OP_DROP, OP_DUP}};
+
+        // (0 in -> 1 out)
+        case OP_SIZE:
+        case OP_OVER:
+        case OP_TUCK:
+        case OP_DEPTH:
+        case OP_DUP:
+        case OP_IFDUP:
+            return {{opcode, OP_DROP}};
+
+        case OP_CHECKLOCKTIMEVERIFY:
+            return {{opcode}};
+
+        case OP_2DROP:
+            return {{OP_2DUP, opcode}};
+
+        case OP_2OVER:
+            return {{opcode, OP_DROP, OP_DROP}};
+
+        // (1 in -> 0 out)
+        case OP_ROLL:
+        case OP_VERIFY:
+        case OP_NIP:
+            return {{opcode, OP_DUP}};
+
+        // (2 in -> 0 out)
+        case OP_EQUALVERIFY:
+        case OP_NUMEQUALVERIFY:
+            return {{OP_DUP, opcode, OP_DUP}};
+
+        // (0 in -> 0 out)
+        case OP_NOP:
+        case OP_SWAP:
+        case OP_2SWAP:
+        case OP_ROT:
+        case OP_2ROT:
+        case OP_INVERT:
+        case OP_PICK:
+            return {{opcode}};
+
+        // (0 in -> 2 out)
+        case OP_2DUP:
+            return {{opcode, OP_DROP, OP_DROP}};
+
+        // (3 in -> 1 out)
+        case OP_WITHIN:
+        case OP_SUBSTR:
+            return {{OP_DUP, OP_DUP, opcode, OP_DROP, OP_DUP}};
+
+        case OP_TOALTSTACK:
+            return {{opcode, OP_FROMALTSTACK}};
+
+        case OP_DROP:
+            return {{opcode, OP_DUP}};
+
+        default:
+            return {};
+    }
+}
+
+
+static ankerl::nanobench::Bench SetupBenchmark() {
+    ankerl::nanobench::Bench bench;
+    bench.output(nullptr)
+         .epochs(Timing::EPOCHS)
+         .epochIterations(Timing::EPOCH_ITERATIONS);
+    SHA256AutoDetect();
+    return bench;
+}
+
+static std::vector<ScriptTemplate> CreateScriptTemplates() {
+    std::vector<ScriptTemplate> script_templates;
+    for (unsigned int op = 0x4c; op <= 0xba; op++) {
+        opcodetype opcode = static_cast<opcodetype>(op);
+        if (!SELECTED_OPCODES.empty() && !SELECTED_OPCODES.contains(opcode)) {
+            continue;
+        }
+        std::string opname = GetOpName(opcode);
+        auto sequences = GetOpcodes(opcode);
+
+        if (sequences.empty()) {
+            std::cout << strprintf("Skipping unsupported opcode 0x%02x (%s)\n", op, opname.c_str());
+            continue;
+        }
+
+        // Create a template for each sequence
+        for (const auto& opcodes : sequences) {
+            std::string sequence_name = GetSequenceName(opcodes);
+            std::string template_name = sequence_name;
+            script_templates.emplace_back(template_name, opcodes, sequence_name);
+        }
+    }
+    return script_templates;
+}
+
+static bool HandleSpecialCases(const ScriptTemplate& script_template,
+    const StackTemplate& stack_config,
+    std::vector<BenchTestCase>& test_cases) {
+    if (script_template.name.find("LEFT") != std::string::npos) {
+        std::vector<opcodetype> left_sequence = {OP_2DUP, OP_LEFT, OP_DROP};
+        CScript left_script = CreateScript(left_sequence);
+        std::string sequence_name = GetSequenceName(left_sequence);
+
+        std::vector<std::pair<std::string, uint64_t>> offsets;
+        if (stack_config.size >= 20) {
+            offsets.emplace_back("10B", 10);
+        }
+        if (stack_config.size >= 200) {
+            offsets.emplace_back("100B", 100);
+        }
+        if (stack_config.size >= 2000) {
+            offsets.emplace_back("1KB", 1000);
+        }
+        if (stack_config.size >= 20000) {
+            offsets.emplace_back("10KB", 10000);
+        }
+        if (stack_config.size >= 200000) {
+            offsets.emplace_back("100KB", 100000);
+        }
+        if (stack_config.size >= 2000000) {
+            offsets.emplace_back("1MB", 1000000);
+        }
+
+        for (const auto& [offset_name, offset_val] : offsets) {
+            auto stack = InitStack(stack_config.size, 1, stack_config.pattern);
+            stack.push_back(Val64(offset_val).move_to_valtype());
+            std::string test_name = sequence_name + "_" + stack_config.name + "_offset_" + offset_name;
+            bool gsr_only = IsGsrOnly(left_sequence, stack_config.size);
+            test_cases.push_back({test_name, stack, left_script, 0, gsr_only});
+        }
+        return true;
+    }
+
+    if (script_template.name.find("RIGHT") != std::string::npos) {
+        std::vector<opcodetype> right_sequence = {OP_2DUP, OP_RIGHT, OP_DROP};
+        CScript right_script = CreateScript(right_sequence);
+        std::string sequence_name = GetSequenceName(right_sequence);
+
+        std::vector<std::pair<std::string, uint64_t>> offsets;
+        if (stack_config.size >= 20) {
+            offsets.emplace_back("10B", 10);
+        }
+        if (stack_config.size >= 200) {
+            offsets.emplace_back("100B", 100);
+        }
+        if (stack_config.size >= 2000) {
+            offsets.emplace_back("1KB", 1000);
+        }
+        if (stack_config.size >= 20000) {
+            offsets.emplace_back("10KB", 10000);
+        }
+        if (stack_config.size >= 200000) {
+            offsets.emplace_back("100KB", 100000);
+        }
+        if (stack_config.size >= 2000000) {
+            offsets.emplace_back("1MB", 1000000);
+        }
+
+        for (const auto& [offset_name, offset_val] : offsets) {
+            auto stack = InitStack(stack_config.size, 1, stack_config.pattern);
+            stack.push_back(Val64(offset_val).move_to_valtype());
+            std::string test_name = sequence_name + "_" + stack_config.name + "_offset_" + offset_name;
+            bool gsr_only = IsGsrOnly(right_sequence, stack_config.size);
+            test_cases.push_back({test_name, stack, right_script, 0, gsr_only});
+        }
+        return true;
+    }
+
+    if (script_template.name.find("LSHIFT") != std::string::npos) {
+        std::vector<opcodetype> lshift_sequence = {OP_2DUP, OP_LSHIFT, OP_DROP};
+        CScript lshift_script = CreateScript(lshift_sequence);
+        std::string sequence_name = GetSequenceName(lshift_sequence);
+
+        std::vector<std::pair<std::string, uint64_t>> shifts;
+        shifts.emplace_back("1bit", 1);
+        shifts.emplace_back("8bits", 8);
+        if (stack_config.size * 8 >= 64) {
+            shifts.emplace_back("64bits", 64);
+        }
+        if (stack_config.size * 8 >= 1024) {
+            shifts.emplace_back("1Kbits", 1024);
+        }
+        if (stack_config.size * 8 >= 10240) {
+            shifts.emplace_back("10Kbits", 10240);
+        }
+        if (stack_config.size * 8 >= 102400) {
+            shifts.emplace_back("100Kbits", 102400);
+        }
+        if (stack_config.size * 8 >= 1048576) {
+            shifts.emplace_back("1Mbits", 1048576);
+        }
+
+        for (const auto& [shift_name, shift_val] : shifts) {
+            auto stack = InitStack(stack_config.size, 1, stack_config.pattern);
+            stack.push_back(Val64(shift_val).move_to_valtype());
+            std::string test_name = sequence_name + "_" + stack_config.name + "_shift_" + shift_name;
+            bool gsr_only = IsGsrOnly(lshift_sequence, stack_config.size);
+            test_cases.push_back({test_name, stack, lshift_script, 0, gsr_only});
+        }
+        return true;
+    }
+
+    if (script_template.name.find("RSHIFT") != std::string::npos) {
+        std::vector<opcodetype> rshift_sequence = {OP_2DUP, OP_RSHIFT, OP_DROP};
+        CScript rshift_script = CreateScript(rshift_sequence);
+        std::string sequence_name = GetSequenceName(rshift_sequence);
+
+        std::vector<std::pair<std::string, uint64_t>> shifts;
+        shifts.emplace_back("1bit", 1);
+        shifts.emplace_back("8bits", 8);
+        if (stack_config.size * 8 >= 64) {
+            shifts.emplace_back("64bits", 64);
+        }
+        if (stack_config.size * 8 >= 1024) {
+            shifts.emplace_back("1Kbits", 1024);
+        }
+        if (stack_config.size * 8 >= 10240) {
+            shifts.emplace_back("10Kbits", 10240);
+        }
+        if (stack_config.size * 8 >= 102400) {
+            shifts.emplace_back("100Kbits", 102400);
+        }
+        if (stack_config.size * 8 >= 1048576) {
+            shifts.emplace_back("1Mbits", 1048576);
+        }
+
+        for (const auto& [shift_name, shift_val] : shifts) {
+            auto stack = InitStack(stack_config.size, 1, stack_config.pattern);
+            stack.push_back(Val64(shift_val).move_to_valtype());
+            std::string test_name = sequence_name + "_" + stack_config.name + "_shift_" + shift_name;
+            bool gsr_only = IsGsrOnly(rshift_sequence, stack_config.size);
+            test_cases.push_back({test_name, stack, rshift_script, 0, gsr_only});
+        }
+        return true;
+    }
+
+    if (script_template.name.find("SUBSTR") != std::string::npos) {
+        std::vector<opcodetype> substr_sequence = {OP_3DUP, OP_SUBSTR, OP_DROP};
+        CScript substr_script = CreateScript(substr_sequence);
+        std::string sequence_name = GetSequenceName(substr_sequence);
+
+        std::vector<std::tuple<std::string, uint64_t, uint64_t>> substr_params;
+        if (stack_config.size >= 20) {
+            substr_params.emplace_back("start0_len10B", 0, 10);
+            substr_params.emplace_back("start5B_len10B", 5, 10);
+        }
+        if (stack_config.size >= 200) {
+            substr_params.emplace_back("start0_len100B", 0, 100);
+            substr_params.emplace_back("start50B_len100B", 50, 100);
+        }
+        if (stack_config.size >= 2000) {
+            substr_params.emplace_back("start0_len1KB", 0, 1000);
+            substr_params.emplace_back("start500B_len1KB", 500, 1000);
+        }
+        if (stack_config.size >= 20000) {
+            substr_params.emplace_back("start0_len10KB", 0, 10000);
+            substr_params.emplace_back("start5KB_len10KB", 5000, 10000);
+        }
+        if (stack_config.size >= 200000) {
+            substr_params.emplace_back("start0_len100KB", 0, 100000);
+            substr_params.emplace_back("start50KB_len100KB", 50000, 100000);
+        }
+        if (stack_config.size >= 2000000) {
+            substr_params.emplace_back("start0_len1MB", 0, 1000000);
+            substr_params.emplace_back("start500KB_len1MB", 500000, 1000000);
+        }
+
+        for (const auto& [param_name, start_val, len_val] : substr_params) {
+            auto stack = InitStack(stack_config.size, 1, stack_config.pattern);
+            stack.push_back(Val64(start_val).move_to_valtype());
+            stack.push_back(Val64(len_val).move_to_valtype());
+            std::string test_name = sequence_name + "_" + stack_config.name + "_" + param_name;
+            bool gsr_only = IsGsrOnly(substr_sequence, stack_config.size);
+            test_cases.push_back({test_name, stack, substr_script, 0, gsr_only});
+        }
+        return true;
+    }
+
+    if (script_template.name.find("ROLL") != std::string::npos || script_template.name.find("PICK") != std::string::npos) {
+        int maximum_size = MAX_TAPSCRIPT_V2_STACK_SIZE;
+        ValtypeStack stack;
+        int roll_index = MAX_TAPSCRIPT_V2_STACK_SIZE - 5;
+        for (int i = 0; i < maximum_size - 1; i++) {
+            stack.push_back(Val64(roll_index).move_to_valtype());
+        }
+        bool gsr_only = true;
+        test_cases.push_back({script_template.name + "_MAX_STACK_SIZE", stack, CreateScript(script_template.opcodes), 0, gsr_only});
+        return true;
+    }
+
+    // stack manipulation operations that need 6 elements on the stack
+    if (script_template.name.find("ROT") != std::string::npos ||
+    script_template.name.find("OVER") != std::string::npos ||
+    script_template.name.find("2OVER") != std::string::npos ||
+    script_template.name.find("2ROT") != std::string::npos ||
+    script_template.name.find("2SWAP") != std::string::npos) {
+        auto stack = InitStack(stack_config.size, 6, stack_config.pattern);
+        bool gsr_only = IsGsrOnly(script_template.opcodes, stack_config.size);
+        test_cases.push_back({script_template.name + "_" + stack_config.name, stack, CreateScript(script_template.opcodes), 0, gsr_only});
+        test_cases.push_back({script_template.name + "_" + stack_config.name, stack, CreateScript(script_template.opcodes), 0, gsr_only});
+        return true;
+    }
+
+    return false;
+}
+
+static bool ContainsOpcode(const std::vector<opcodetype>& opcodes, opcodetype target) {
+    return std::find(opcodes.begin(), opcodes.end(), target) != opcodes.end();
+}
+
+static std::vector<BenchTestCase> CreateTestCases() {
+    std::vector<StackTemplate> config_stack_templates = GetStackTemplates();
+    std::vector<ScriptTemplate> script_templates = CreateScriptTemplates();
+    std::vector<BenchTestCase> test_cases;
+    test_cases.reserve(script_templates.size() * config_stack_templates.size());
+
+    for (const auto& script_template : script_templates) {
+        for (auto& stack_config : config_stack_templates) {
+            if (ShouldSkipCase(script_template.name, stack_config.name)) {
+                continue;
+            }
+            if (HandleSpecialCases(script_template, stack_config, test_cases)) {
+                continue;
+            }
+
+            // OP_3DUP requires 3 stack elements; skip 2MB case for these
+            bool uses_3dup = ContainsOpcode(script_template.opcodes, OP_3DUP);
+            if (uses_3dup && stack_config.name == "2MBx2") {
+                continue;
+            }
+            int stack_count = uses_3dup ? 3 : stack_config.count;
+
+            bool gsr_only = IsGsrOnly(script_template.opcodes, stack_config.size);
+            test_cases.push_back({
+                script_template.name + "_" + stack_config.name,
+                InitStack(stack_config.size, stack_count, stack_config.pattern),
+                CreateScript(script_template.opcodes),
+                0,
+                gsr_only
+            });
+        }
+    }
+
+    std::sort(test_cases.begin(), test_cases.end(), [](const BenchTestCase& a, const BenchTestCase& b) { return a.name < b.name; });
+    test_cases.erase(std::unique(test_cases.begin(), test_cases.end(), [](const BenchTestCase& a, const BenchTestCase& b) { return a.name == b.name; }), test_cases.end());
+
+    return test_cases;
+}
+
+static void RunBenchmark(ankerl::nanobench::Bench& bench,
+                         BenchTestCase& test_case) {
+    BaseSignatureChecker checker;
+    ScriptExecutionData sdata;
+    ScriptError serror;
+
+    const uint64_t varops_block_budget = TOTAL_VAROPS_BUDGET;
+    assert(varops_block_budget > 2e10);
+    uint64_t working_budget = varops_block_budget;
+    bool result = false;
+
+    const size_t stack_pool_size = Timing::EPOCHS * Timing::EPOCH_ITERATIONS;
+    size_t stack_index = 0;
+    std::vector<ValtypeStack> stack_pool;
+    stack_pool.reserve(stack_pool_size);
+    for (size_t i = 0; i < stack_pool_size; ++i) {
+        stack_pool.push_back(test_case.stack);
+    }
+
+    // warmup for every benchmark to provide more stable results, fixes OP_2DUP memory issues on intel chips
+    CScript warmup_script = CreateScript(GetOpcodes(OP_NOP).front());
+    uint64_t warmup_budget = varops_block_budget;
+    ScriptError warmup_error;
+    ValtypeStack warmup_stack;
+    EvalGsrScript(warmup_stack, warmup_script, 0, checker,
+                SigVersion::TAPSCRIPT_V2, sdata, warmup_budget, &warmup_error);
+
+
+    bench.run(test_case.name, [&] {
+        assert(stack_index < stack_pool_size);
+        ValtypeStack& working_stack = stack_pool[stack_index];
+        working_budget = varops_block_budget;
+        result = EvalGsrScript(working_stack, test_case.script, 0, checker,
+                        SigVersion::TAPSCRIPT_V2, sdata, working_budget, &serror);
+        ++stack_index;
+    });
+
+    if (!result) {
+        std::string error_msg = ScriptErrorString(serror);
+        if (error_msg.find("Varops count exceeded") == std::string::npos) {
+            std::cout << strprintf("Script error: %s\n", error_msg.c_str());
+        }
+    }
+    if (working_budget != varops_block_budget && test_case.varops_consumed == 0) {
+        test_case.varops_consumed = varops_block_budget - working_budget;
+    }
+    serror = SCRIPT_ERR_OK;
+}
+
+static void RunSchnorrBenchmark(ankerl::nanobench::Bench &bench, const std::string& name) {
+    bench.epochIterations(Timing::SCHNORR_EPOCH_ITERATIONS).epochs(Timing::SCHNORR_EPOCHS);
+
+    KeyPair::ECC_Start();
+    CKey key;
+    std::vector<unsigned char> test_key(32, 0);
+    test_key[31] = 1;
+    key.Set(test_key.begin(), test_key.end(), false);
+    CPubKey pubkey = key.GetPubKey();
+
+    std::vector<unsigned char> vchSig(64);
+    const uint256 hash = uint256::ONE;
+    key.SignSchnorr(hash, vchSig, nullptr, hash);
+
+    XOnlyPubKey xpub(pubkey);
+    std::span<const unsigned char> sigbytes{vchSig.data(), vchSig.size()};
+    assert(sigbytes.size() == 64);
+
+    bench.run(name, [&] {
+        bool res = xpub.VerifySchnorr(hash, sigbytes);
+        assert(res);
+    });
+
+    KeyPair::ECC_Stop();
+    bench.epochs(Timing::EPOCHS).epochIterations(Timing::EPOCH_ITERATIONS);
+}
+
+static void RunAllBenchmarks(ankerl::nanobench::Bench& bench, std::vector<BenchTestCase>& test_cases) {
+    if (!SILENT_MODE) {
+        std::cout << "Running Schnorr signature benchmark...\n";
+    }
+    RunSchnorrBenchmark(bench, "Schnorr signature validation");
+
+    double schnorr_median_time = 0.0;
+    if (const auto* schnorr_result = FindResult(bench, "Schnorr signature validation")) {
+        schnorr_median_time = schnorr_result->median(ankerl::nanobench::Result::Measure::elapsed);
+    }
+
+    double schnorr_block_time = schnorr_median_time * SIGNATURES_PER_BLOCK;
+    if (!SILENT_MODE) {
+        std::cout << strprintf("Schnorr block time: %.3f seconds\n", schnorr_block_time);
+    }
+    int bench_count = 0;
+
+    for (BenchTestCase& test_case : test_cases) {
+        RunBenchmark(bench, test_case);
+
+        if (const auto* result = FindResult(bench, test_case.name)) {
+            double median_sec = result->median(ankerl::nanobench::Result::Measure::elapsed);
+            double schnorr_times = median_sec / schnorr_median_time;
+
+            if (!SILENT_MODE) {
+                std::cout << strprintf("%3d/%zu: %-30s %.3f seconds (%6.0f Schnorrs, %6.1f%% varops used)\n",
+                       ++bench_count, test_cases.size(), test_case.name.c_str(), median_sec, schnorr_times,
+                       (double(test_case.varops_consumed) / TOTAL_VAROPS_BUDGET) * 100.0);
+            } else {
+                ++bench_count;
+            }
+        }
+    }
+}
+
+static std::vector<BenchResult> CollectResults(const ankerl::nanobench::Bench& bench, const std::vector<BenchTestCase>& test_cases) {
+    std::vector<BenchResult> results;
+    results.reserve(test_cases.size());
+
+    for (const auto& test_case : test_cases) {
+        if (const auto* result = FindResult(bench, test_case.name)) {
+            double median_sec = result->median(ankerl::nanobench::Result::Measure::elapsed);
+            double per_varop_ns = test_case.varops_consumed > 0 ? (median_sec * 1e9) / test_case.varops_consumed : 0;
+            results.push_back({test_case.name, median_sec, test_case.varops_consumed, per_varop_ns, test_case.is_gsr_only});
+        }
+    }
+
+    double schnorr_median_time = 0.0;
+    if (const auto* schnorr_result = FindResult(bench, "Schnorr signature validation")) {
+        schnorr_median_time = schnorr_result->median(ankerl::nanobench::Result::Measure::elapsed);
+    }
+
+    results.push_back({"Schnorr signature validation", schnorr_median_time * SIGNATURES_PER_BLOCK, 0, 0, false});
+    std::sort(results.begin(), results.end(), [](const auto& a, const auto& b) { return a.median_sec > b.median_sec; });
+
+    return results;
+}
+
+static void PrintWorstCases(std::vector<BenchResult>& results) {
+    std::sort(results.begin(), results.end(), [](const BenchResult& a, const BenchResult& b) { return a.median_sec > b.median_sec; });
+
+    std::cout << "\n================================================================================\n";
+    std::cout << "SLOWEST OPERATIONS\n";
+    std::cout << "================================================================================\n";
+
+    double schnorr_median_time = 0.0;
+    for (const auto& result : results) {
+        if (result.name == "Schnorr signature validation") {
+            schnorr_median_time = result.median_sec;
+            break;
+        }
+    }
+
+    // Calculate suggested maximum varops budget based on slowest 100% budget operation
+    double slowest_100_percent_time = 0.0;
+    for (const auto& result : results) {
+        if (result.name != "Schnorr signature validation" &&
+            result.varops_consumed >= TOTAL_VAROPS_BUDGET * 0.99) {
+            if (result.median_sec > slowest_100_percent_time) {
+                slowest_100_percent_time = result.median_sec;
+            }
+        }
+    }
+
+    if (slowest_100_percent_time > 0 && schnorr_median_time > 0) {
+        double suggested_budget = VAROPS_BUDGET_PER_BYTE / slowest_100_percent_time * schnorr_median_time;
+        std::cout << "\nSUGGESTED MAXIMUM VAROPS BUDGET:\n";
+        std::cout << strprintf("   Based on slowest 100%% varops operation (%.3f sec) vs Schnorr (%.3f sec):\n",
+               slowest_100_percent_time, schnorr_median_time);
+        std::cout << strprintf("   Suggested budget: %.0f varops per weight unit (current: %d)\n",
+               suggested_budget, VAROPS_BUDGET_PER_BYTE);
+        std::cout << strprintf("   Formula: %d / %.3f * %.3f = %.0f\n\n",
+               VAROPS_BUDGET_PER_BYTE, slowest_100_percent_time, schnorr_median_time, suggested_budget);
+    }
+
+    // Separate results into slower and faster than Schnorr
+    std::vector<BenchResult> slower_than_schnorr;
+    std::vector<BenchResult> faster_than_schnorr;
+    BenchResult* schnorr_result = nullptr;
+
+    for (auto& result : results) {
+        if (result.name == "Schnorr signature validation") {
+            schnorr_result = &result;
+        } else if (schnorr_median_time > 0 && result.median_sec > schnorr_median_time) {
+            slower_than_schnorr.push_back(result);
+        } else {
+            faster_than_schnorr.push_back(result);
+        }
+    }
+
+    // Print operations slower than Schnorr
+    if (!slower_than_schnorr.empty()) {
+        std::cout << "\nSLOWER THAN SCHNORR SIGNATURE VALIDATION:\n\n";
+        size_t printed_count = 0;
+        for (size_t i = 0; i < slower_than_schnorr.size(); i++) {
+            const auto& result = slower_than_schnorr[i];
+            double schnorr_times = schnorr_median_time > 0 ? result.median_sec / schnorr_median_time * SIGNATURES_PER_BLOCK : 0;
+            if (schnorr_times > SIGNATURES_PER_BLOCK / 2) {
+                std::cout << strprintf("%zu. %-30s %.3f seconds (%6.0f Schnorrs, %6.1f%% varops used)\n",
+                       ++printed_count, result.name.c_str(), result.median_sec, schnorr_times,
+                       (double(result.varops_consumed) / TOTAL_VAROPS_BUDGET) * 100.0);
+            }
+        }
+    }
+
+    // Print Schnorr as divider
+    if (schnorr_result) {
+        std::cout << "\n" << std::string(80, '-') << "\n";
+        double schnorr_times = SIGNATURES_PER_BLOCK;
+        std::cout << strprintf("%-30s %.3f seconds (%6.0f Schnorrs, %6.1f%% varops used)\n",
+               schnorr_result->name.c_str(), schnorr_result->median_sec, schnorr_times,
+               (double(schnorr_result->varops_consumed) / TOTAL_VAROPS_BUDGET) * 100.0);
+        std::cout << std::string(80, '-') << "\n\n";
+    }
+
+    // Print operations faster than Schnorr
+    if (!faster_than_schnorr.empty()) {
+        std::cout << "FASTER THAN SCHNORR SIGNATURE VALIDATION:\n\n";
+        int count = std::min(100 - static_cast<int>(slower_than_schnorr.size()) - 1, static_cast<int>(faster_than_schnorr.size()));
+        int printed_count = 0;
+        for (int i = 0; i < count; i++) {
+            const auto& result = faster_than_schnorr[i];
+            double schnorr_times = schnorr_median_time > 0 ? result.median_sec / schnorr_median_time * SIGNATURES_PER_BLOCK : 0;
+            if (schnorr_times > SIGNATURES_PER_BLOCK / 2) {
+                std::cout << strprintf("%d. %-30s %.3f seconds (%6.0f Schnorrs, %6.1f%% varops used)\n",
+                       ++printed_count, result.name.c_str(), result.median_sec, schnorr_times,
+                       (double(result.varops_consumed) / TOTAL_VAROPS_BUDGET) * 100.0);
+            }
+        }
+    }
+
+    std::cout << "================================================================================\n";
+}
+
+static std::string GetSystemInfo() {
+    std::ostringstream info;
+
+    std::string cpu_name = "Unknown";
+#if defined(__APPLE__)
+    FILE* fp = popen("sysctl -n machdep.cpu.brand_string", "r");
+    if (fp) {
+        char buffer[256];
+        if (fgets(buffer, sizeof(buffer), fp)) {
+            cpu_name = buffer;
+            // Remove trailing newline
+            if (!cpu_name.empty() && cpu_name.back() == '\n') {
+                cpu_name.pop_back();
+            }
+        }
+        pclose(fp);
+    }
+#elif defined(__linux__)
+    FILE* cpuinfo = fopen("/proc/cpuinfo", "r");
+    if (cpuinfo) {
+        char line[256];
+        while (fgets(line, sizeof(line), cpuinfo)) {
+            if (strncmp(line, "model name", 10) == 0) {
+                const char* sep = strchr(line, ':');
+                if (sep) {
+                    cpu_name = sep + 2; // Skip ": "
+                    // Remove trailing newline
+                    if (!cpu_name.empty() && cpu_name.back() == '\n') {
+                        cpu_name.pop_back();
+                    }
+                    break;
+                }
+            }
+        }
+        fclose(cpuinfo);
+    }
+#endif
+
+    // Get architecture
+    std::string architecture = "Unknown";
+#if defined(__x86_64__) || defined(__amd64__) || defined(_M_X64)
+    architecture = "x86_64";
+#elif defined(__i386__) || defined(_M_IX86)
+    architecture = "x86";
+#elif defined(__aarch64__) || defined(_M_ARM64)
+    architecture = "ARM64";
+#elif defined(__arm__) || defined(_M_ARM)
+    architecture = "ARM";
+#endif
+
+    // Get compiler
+    std::string compiler = "Unknown";
+#if defined(__clang__)
+    compiler = "Clang " + util::ToString(__clang_major__) + "." +
+               util::ToString(__clang_minor__) + "." +
+               util::ToString(__clang_patchlevel__);
+#elif defined(__GNUC__)
+    compiler = "GCC " + util::ToString(__GNUC__) + "." +
+               util::ToString(__GNUC_MINOR__) + "." +
+               util::ToString(__GNUC_PATCHLEVEL__);
+#elif defined(_MSC_VER)
+    compiler = "MSVC " + util::ToString(_MSC_VER);
+#endif
+
+    // Get SHA256 implementation
+    std::string sha256_impl = SHA256AutoDetect();
+
+    info << "# CPU: " << cpu_name << "\n";
+    info << "# Architecture: " << architecture << "\n";
+    info << "# Compiler: " << compiler << "\n";
+    info << "# SHA256 Implementation: " << sha256_impl << "\n";
+
+    return info.str();
+}
+
+static void SaveResultsToFile(const std::vector<BenchResult>& results, const std::string& filepath) {
+    std::ofstream file(filepath);
+    if (!file.is_open()) {
+        std::cerr << "Error: Could not open file " << filepath << " for writing" << std::endl;
+        return;
+    }
+
+    double schnorr_median_time = 0.0;
+    for (const auto& result : results) {
+        if (result.name == "Schnorr signature validation") {
+            schnorr_median_time = result.median_sec;
+            break;
+        }
+    }
+
+    file << GetSystemInfo();
+    file << "#\n";
+
+    double slowest_100_percent_time = 0.0;
+    for (const auto& result : results) {
+        if (result.name != "Schnorr signature validation" &&
+            result.varops_consumed >= TOTAL_VAROPS_BUDGET * 0.99) {
+            if (result.median_sec > slowest_100_percent_time) {
+                slowest_100_percent_time = result.median_sec;
+            }
+        }
+    }
+
+    if (slowest_100_percent_time > 0 && schnorr_median_time > 0) {
+        double suggested_budget = VAROPS_BUDGET_PER_BYTE / slowest_100_percent_time * schnorr_median_time;
+        file << "# SUGGESTED MAXIMUM VAROPS BUDGET:\n";
+        file << "# Based on slowest 100% varops operation (" << slowest_100_percent_time
+             << " sec) vs Schnorr (" << schnorr_median_time << " sec):\n";
+        file << "# Suggested budget: " << suggested_budget
+             << " varops per weight unit (current: " << VAROPS_BUDGET_PER_BYTE << ")\n";
+        file << "# Formula: " << VAROPS_BUDGET_PER_BYTE << " / " << slowest_100_percent_time
+             << " * " << schnorr_median_time << " = " << suggested_budget << "\n";
+        file << "#\n";
+    }
+
+    file << "Rank,Name,Seconds,Schnorr_Equivalents,Varops_Percentage,Is_GSR_Only\n";
+
+    for (size_t i = 0; i < results.size(); i++) {
+        double schnorr_times = schnorr_median_time > 0 ? results[i].median_sec / schnorr_median_time * SIGNATURES_PER_BLOCK : 0;
+        double varops_percentage = (double(results[i].varops_consumed) / TOTAL_VAROPS_BUDGET) * 100.0;
+
+        file << (i + 1) << ","
+             << results[i].name << ","
+             << results[i].median_sec << ","
+             << schnorr_times << ","
+             << varops_percentage << ","
+             << (results[i].is_gsr_only ? "true" : "false") << "\n";
+    }
+
+    file.close();
+    if (!SILENT_MODE) {
+        std::cout << "Results saved to: " << filepath << std::endl;
+    }
+}
+
+static opcodetype GetOpcodeFromName(const std::string& name) {
+    static std::map<std::string, opcodetype> opcode_map;
+    if (opcode_map.empty()) {
+        for (unsigned int op = 0; op <= 0xff; ++op) {
+            opcodetype opcode = static_cast<opcodetype>(op);
+            std::string opname = GetOpName(opcode);
+            if (opname != "OP_UNKNOWN") opcode_map[opname] = opcode;
+        }
+    }
+
+    std::string upper_name = name;
+    std::transform(upper_name.begin(), upper_name.end(), upper_name.begin(), ::toupper);
+
+    if (opcode_map.contains(upper_name)) return opcode_map[upper_name];
+    if (opcode_map.contains("OP_" + upper_name)) return opcode_map["OP_" + upper_name];
+
+    throw std::invalid_argument("Unknown opcode name: " + name);
+}
+
+static void ParseArguments(int argc, char* argv[]) {
+    for (int i = 1; i < argc; i++) {
+        std::string arg = argv[i];
+
+        if (arg == "--opcodes") {
+            i++;
+            std::vector<std::string> opcode_names;
+            while (i < argc && argv[i][0] != '-') {
+                opcode_names.emplace_back(argv[i++]);
+            }
+            i--;
+
+            if (opcode_names.empty()) {
+                std::cerr << "Error: --opcodes requires at least one opcode name" << std::endl;
+                exit(1);
+            }
+
+            try {
+                if (!SILENT_MODE) {
+                    std::cout << "Running benchmarks for opcodes: ";
+                    for (const auto& opcode_name : opcode_names) {
+                        opcodetype opcode = GetOpcodeFromName(opcode_name);
+                        SELECTED_OPCODES.insert(opcode);
+                        std::cout << GetOpName(opcode) << " ";
+                    }
+                    std::cout << std::endl;
+                } else {
+                    for (const auto& opcode_name : opcode_names) {
+                        opcodetype opcode = GetOpcodeFromName(opcode_name);
+                        SELECTED_OPCODES.insert(opcode);
+                    }
+                }
+            } catch (const std::invalid_argument& e) {
+                std::cerr << "Error: " << e.what() << std::endl;
+                std::cerr << "Available opcodes: OP_ROLL, OP_SHA256, OP_ADD, OP_MUL, etc." << std::endl;
+                exit(1);
+            }
+        } else if (arg == "--silent") {
+            SILENT_MODE = true;
+        } else if (arg == "--file" && i + 1 < argc) {
+            OUTPUT_FILE = argv[++i];
+            if (!SILENT_MODE) {
+                std::cout << "Results will be saved to: " << OUTPUT_FILE << std::endl;
+            }
+        } else if (arg == "--epochs" && i + 1 < argc) {
+            try {
+                auto epochs = ToIntegral<int>(argv[++i]);
+                if (!epochs || *epochs <= 0) throw std::invalid_argument("Epochs must be positive");
+                Timing::EPOCHS = *epochs;
+                if (!SILENT_MODE) {
+                    std::cout << "Setting epochs to: " << Timing::EPOCHS << std::endl;
+                }
+            } catch (const std::exception& e) {
+                std::cerr << "Error parsing epochs: " << e.what() << std::endl;
+                exit(1);
+            }
+        } else if (arg == "--help" || arg == "-h") {
+            std::cout << "Usage: " << argv[0] << " [OPTIONS]\n"
+                      << "Options:\n"
+                      << "  --opcodes <op1> [op2] ...  Run benchmarks for specific opcodes\n"
+                      << "  --epochs <number>          Set number of benchmark epochs\n"
+                      << "  --silent                   Suppress output except for worst cases\n"
+                      << "  --file <filepath>          Save all results to CSV file\n"
+                      << "  --help, -h                 Show this help message\n\n"
+                      << "Example opcodes: OP_ROLL, OP_SHA256, OP_ADD, OP_MUL, OP_CAT\n"
+                      << "Example usage:\n"
+                      << "  " << argv[0] << " --opcodes OP_ROLL OP_SHA256\n"
+                      << "  " << argv[0] << " --opcodes OP_ADD OP_MUL --epochs 10\n"
+                      << "  " << argv[0] << " --silent\n"
+                      << "  " << argv[0] << " --file results.csv" << std::endl;
+            exit(0);
+        }
+    }
+}
+
+int main(int argc, char* argv[]) {
+    ParseArguments(argc, argv);
+
+    ankerl::nanobench::Bench bench = SetupBenchmark();
+    std::vector<BenchTestCase> test_cases = CreateTestCases();
+
+    RunAllBenchmarks(bench, test_cases);
+
+    std::vector<BenchResult> results = CollectResults(bench, test_cases);
+    PrintWorstCases(results);
+
+    if (!OUTPUT_FILE.empty()) {
+        SaveResultsToFile(results, OUTPUT_FILE);
+    }
+}
diff --git a/src/bench/evalscript.cpp b/src/bench/evalscript.cpp
new file mode 100644
index 000000000000..c78a96ea7780
--- /dev/null
+++ b/src/bench/evalscript.cpp
@@ -0,0 +1,348 @@
+#include <bench/bench.h>
+
+#include <cstdlib>
+#include <consensus/consensus.h>
+#include <script/interpreter.h>
+#include <script/script.h>
+#include <script/val64.h>
+#include <script/valtype_stack.h>
+#include <util/strencodings.h>
+
+static size_t get_val(size_t default_val, const char *var)
+{
+    const char *env = getenv(var);
+    if (!env)
+        return default_val;
+    auto val = ToIntegral<long>(env);
+    if (!val || *val == 0)
+        return default_val;
+    return static_cast<size_t>(*val);
+}
+
+static size_t get_op1_bytes(size_t default_val = MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE)
+{
+    return get_val(default_val, "EVALSCRIPT_OP1_BYTES");
+}
+
+static size_t get_op2_bytes(size_t default_val = MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE)
+{
+    return get_val(default_val, "EVALSCRIPT_OP2_BYTES");
+}
+
+// op1 is top of stack, op2 is second on stack.
+static void BenchEvalScript(benchmark::Bench& bench,
+                            const CScript &script,
+                            const std::vector<unsigned char> &op1,
+                            const std::vector<unsigned char> &op2)
+{
+    BaseSignatureChecker checker;
+    ScriptExecutionData sdata;
+    ScriptError serror;
+    size_t cooling = get_val(0, "EVALSCRIPT_COOLING_BYTES");
+
+    std::vector<unsigned char> cool1(cooling/2, 1), cool2(cooling/2, 1);
+
+    bench.warmup(10).unit("ops").run([&] {
+        std::vector<std::vector<unsigned char> > stack(2);
+        ankerl::nanobench::doNotOptimizeAway(stack[0] = op2);
+
+        // In case we want to clear cache, write out a crap load.
+        for (size_t i = 0; i < cooling / 2; i++) {
+            cool1[i] = (i < op1.size() ? op1[i] : i) + cooling;
+            cool2[i] = (i < op2.size() ? op2[i] : i) - cooling;
+        }
+
+        // Set up stack: do manual copy so it's cache hot!
+        stack[1].resize(op1.size());
+        for (size_t i = 0; i < stack[1].size(); i++)
+            stack[1][i] = op1[i];
+
+        uint64_t varops_budget = 1e14;
+
+        ValtypeStack valtype_stack{stack};
+        if (!EvalGsrScript(valtype_stack, script, 0, checker,
+                        SigVersion::TAPSCRIPT_V2, sdata, varops_budget, &serror)) {
+            std::cerr << "EvalScript error " << ScriptErrorString(serror) << std::endl;
+            assert(0);
+        }
+
+        // Empty stack manually for better comparison!
+        while (!stack.empty())
+            stack.pop_back();
+    });
+}
+
+// Empty case.
+static void EvalScriptNopNop(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes(), 1), op2(get_op2_bytes(), 2);
+    CScript script;
+
+    script << OP_NOP4 << OP_NOP4;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptNopNop, benchmark::PriorityLevel::HIGH);
+
+// BIP#ops: We assume that the manipulation of the stack vector itself (e.g. OP_DROP) is negligible.
+static void EvalScriptDropDrop(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes(), 1), op2(get_op2_bytes(), 2);
+    CScript script;
+
+    script << OP_DROP << OP_DROP;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptDropDrop, benchmark::PriorityLevel::HIGH);
+
+// Verify both
+static void EvalScriptVerifyVerify(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes()), op2(get_op2_bytes());
+    CScript script;
+
+    // Right at the tail, to force worst-case traversal
+    op1.at(op1.size()-1) = 1;
+    op2.at(op2.size()-1) = 1;
+    script << OP_VERIFY << OP_VERIFY;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptVerifyVerify, benchmark::PriorityLevel::HIGH);
+
+// Check they're equal
+static void EvalScriptEqual(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes(), 1), op2(get_op2_bytes(), 1);
+    CScript script;
+
+    script << OP_EQUAL;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptEqual, benchmark::PriorityLevel::HIGH);
+
+// Make a copy, twice
+static void EvalScriptDropDupDropDup(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes()), op2(get_op2_bytes());
+    CScript script;
+
+    script << OP_DROP << OP_DUP << OP_DROP << OP_DUP;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptDropDupDropDup, benchmark::PriorityLevel::HIGH);
+
+// This modifies the element, so we can compare read costs vs r/w costs.
+static void EvalScriptInvertDropInvert(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes(), 1), op2(get_op2_bytes(), 2);
+    CScript script;
+
+    script << OP_INVERT << OP_DROP << OP_INVERT;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptInvertDropInvert, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptDropInvert(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes(), 1), op2(get_op2_bytes(), 2);
+    CScript script;
+
+    script << OP_DROP << OP_INVERT;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptDropInvert, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptInvert(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes(), 1), op2(get_op2_bytes(), 2);
+    CScript script;
+
+    script << OP_INVERT;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptInvert, benchmark::PriorityLevel::HIGH);
+
+// Simple binary ops
+static void EvalScriptAnd(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes(), 1), op2(get_op2_bytes(), 2);
+    CScript script;
+
+    script << OP_AND;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptAnd, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptOr(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes(), 1), op2(get_op2_bytes(), 2);
+    CScript script;
+
+    script << OP_OR;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptOr, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptAdd(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes(), 1), op2(get_op2_bytes(), 2);
+    CScript script;
+
+    script << OP_ADD;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptAdd, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptAddOverflow(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes()-1, 0xFF), op2(get_op2_bytes()-1);
+    CScript script;
+
+    op2[0] = 1;
+    script << OP_ADD;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptAddOverflow, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptSub(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes(), 1), op2(get_op2_bytes(), 2);
+    CScript script;
+
+    script << OP_SUB;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptSub, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptMul(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE / 100), 1),
+        op2(get_op2_bytes(MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE / 100), 1);
+    CScript script;
+
+    script << OP_MUL;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptMul, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptDiv(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes()), op2(get_op2_bytes());
+    CScript script;
+
+    script << OP_DIV;
+
+    for (size_t i = 0; i < op1.size(); i++)
+        op1[i] = static_cast<unsigned char>(255 - (i % 256));
+
+    for (size_t i = 0; i < op2.size(); i++)
+        op2[i] = static_cast<unsigned char>(1 + (i % 256));
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptDiv, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptUpshift1(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes()-1, 1), op2(get_op2_bytes()-1, 2);
+    CScript script;
+
+    script << 1 << OP_LSHIFT << OP_DROP << 1 << OP_LSHIFT;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptUpshift1, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptUpshift16000001(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes()-2000001, 1), op2(get_op2_bytes()-2000001, 2);
+    CScript script;
+    // We need this encoded as normal LE, not CScriptNum!
+    Val64 num64(16000001);
+    const std::vector<unsigned char> num = num64.move_to_valtype();
+
+    script << num << OP_LSHIFT << OP_DROP << num << OP_LSHIFT;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptUpshift16000001, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptUpshift16000000(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes()-2000000, 1), op2(get_op2_bytes()-2000000, 2);
+    CScript script;
+    // We need this encoded as normal LE, not CScriptNum!
+    Val64 num64(16000000);
+    const std::vector<unsigned char> num = num64.move_to_valtype();
+
+    script << num << OP_LSHIFT << OP_DROP << num << OP_LSHIFT;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptUpshift16000000, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptDownshift1(benchmark::Bench& bench)
+{
+    // Need 1 byte capacity for push of 1!
+    std::vector<unsigned char> op1(get_op1_bytes()-1, 1), op2(get_op2_bytes());
+    CScript script;
+
+    script << 1 << OP_RSHIFT << OP_DROP << 1 << OP_RSHIFT;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptDownshift1, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptDownshift16000001(benchmark::Bench& bench)
+{
+    // Need 3 byte capacity for push of 16000001!
+    std::vector<unsigned char> op1(get_op1_bytes() - 3, 1), op2(get_op2_bytes(), 2);
+    CScript script;
+    // We need this encoded as normal LE, not CScriptNum!
+    Val64 num64(16000001);
+    const std::vector<unsigned char> num = num64.move_to_valtype();
+
+    script << num << OP_RSHIFT << OP_DROP << num << OP_RSHIFT;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptDownshift16000001, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptDownshift16000000(benchmark::Bench& bench)
+{
+    // Need 3 byte capacity for push of 16000001!
+    std::vector<unsigned char> op1(get_op1_bytes()-3, 1), op2(get_op2_bytes(), 2);
+    CScript script;
+    // We need this encoded as normal LE, not CScriptNum!
+    Val64 num64(16000000);
+    const std::vector<unsigned char> num = num64.move_to_valtype();
+
+    script << num << OP_RSHIFT << OP_DROP << num << OP_RSHIFT;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptDownshift16000000, benchmark::PriorityLevel::HIGH);
+
+static void EvalScriptSHA256DropSHA256(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> op1(get_op1_bytes()), op2(get_op2_bytes());
+    CScript script;
+
+    script << OP_SHA256 << OP_DROP << OP_SHA256;
+
+    BenchEvalScript(bench, script, op1, op2);
+}
+BENCHMARK(EvalScriptSHA256DropSHA256, benchmark::PriorityLevel::HIGH);
diff --git a/src/bench/micro.cpp b/src/bench/micro.cpp
new file mode 100644
index 000000000000..536f9510fe6b
--- /dev/null
+++ b/src/bench/micro.cpp
@@ -0,0 +1,265 @@
+// Copyright (c) The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+#include <bench/bench.h>
+
+#include <random.h>
+#include <streams.h>
+
+#include <cstddef>
+#include <vector>
+#include <crypto/sha256.h>
+#include <script/val64.h>
+#include <util/strencodings.h>
+
+// A de-privatizing child.
+class Val64Test: public Val64 {
+public:
+    using Val64::Val64;
+    static void set_force_unaligned(bool val) { Val64::force_unaligned = val; }
+    uint64_t *access_u64() const { return m_u64span.data(); }
+    size_t num_u64() const { return m_u64span.size(); }
+    void set(size_t index, uint64_t v) { Val64::set(index, v); }
+    uint64_t get(size_t index) const { return Val64::get(index); }
+};
+
+#define DEFAULT_BENCH_SIZE 4000000
+
+static size_t bench_size(const char *varname = "MICRO_BENCH_BYTES")
+{
+    const char *env = getenv(varname);
+    if (!env)
+        return DEFAULT_BENCH_SIZE;
+    auto val = ToIntegral<long>(env);
+    return val ? static_cast<size_t>(*val) : DEFAULT_BENCH_SIZE;
+}
+
+// For a simple speed comparison
+static void MicroSHA256(benchmark::Bench& bench)
+{
+    std::vector<unsigned char> v1(bench_size(), 1);
+
+    bench.run([&] {
+        CSHA256().Write(v1.data(), v1.size()).Finalize(v1.data());
+    });
+}
+BENCHMARK(MicroSHA256, benchmark::PriorityLevel::HIGH);
+
+/* Read-only benchmarks */
+static void MicroReadMemcmpSelf(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size + 64, 1);
+    std::vector<unsigned char> v2(size + 64, 1);
+
+    bench.run([&] {
+        if (memcmp(v1.data(), v1.data() + 64, size) != 0)
+            abort();
+        if (memcmp(v2.data(), v2.data() + 64, size) != 0)
+            abort();
+    });
+}
+BENCHMARK(MicroReadMemcmpSelf, benchmark::PriorityLevel::HIGH);
+
+static void MicroReadMemchr(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 1);
+    std::vector<unsigned char> v2(size, 1);
+
+    bench.run([&] {
+        if (size > 0 && memchr(v1.data(), 0, size) != nullptr)
+            abort();
+        if (size > 0 && memchr(v2.data(), 0, size) != nullptr)
+            abort();
+    });
+}
+BENCHMARK(MicroReadMemchr, benchmark::PriorityLevel::HIGH);
+
+static void MicroReadManual(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 1);
+    std::vector<unsigned char> v2(size, 1);
+
+    Val64Test v641(v1), v642(v2);
+
+    bench.run([&] {
+        size_t size = v641.num_u64();
+        for (size_t i = 0; i < size; i++) {
+            if (v641.get(i) != v642.get(i))
+                abort();
+        }
+    });
+}
+BENCHMARK(MicroReadManual, benchmark::PriorityLevel::HIGH);
+
+/* Write benchmarks. */
+static void MicroWriteMemset(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 1);
+    std::vector<unsigned char> v2(size, 1);
+    char n = 2;
+
+    bench.run([&] {
+        memset(v1.data(), n, size);
+        memset(v2.data(), n, size);
+        n++;
+    });
+
+    /* Use it so it can't be optimized out */
+    assert(v1.empty() || memchr(v1.data(), n, v1.size()) == nullptr);
+    assert(v2.empty() || memchr(v2.data(), n, v2.size()) == nullptr);
+}
+BENCHMARK(MicroWriteMemset, benchmark::PriorityLevel::HIGH);
+
+static void MicroWriteManual(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 1);
+    std::vector<unsigned char> v2(size, 1);
+
+    Val64Test v641(v1), v642(v2);
+    uint64_t n = 1;
+
+    bench.run([&] {
+        size_t size = v641.num_u64();
+        for (size_t i = 0; i < size; i++)
+            v641.set(i, n);
+        for (size_t i = 0; i < size; i++)
+            v642.set(i, n);
+    });
+}
+BENCHMARK(MicroWriteManual, benchmark::PriorityLevel::HIGH);
+
+static void MicroRWInvert(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 1);
+    std::vector<unsigned char> v2(size, 1);
+
+    Val64Test v641(v1), v642(v2);
+    uint64_t *p1, *p2;
+
+    p1 = v641.access_u64();
+    p2 = v642.access_u64();
+
+    bench.run([&] {
+        for (size_t i = 0; i < v641.num_u64(); i++)
+            p1[i] = ~p1[i];
+        for (size_t i = 0; i < v642.num_u64(); i++)
+            p2[i] = ~p2[i];
+    });
+
+    /* Use it so it can't be optimized out */
+    assert(v1.empty() || memchr(v1.data(), 2, v1.size()) == nullptr);
+    assert(v2.empty() || memchr(v2.data(), 2, v2.size()) == nullptr);
+}
+BENCHMARK(MicroRWInvert, benchmark::PriorityLevel::HIGH);
+
+static void MicroRWAnd(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 1);
+    std::vector<unsigned char> v2(size, 1);
+
+    Val64Test v641(v1), v642(v2);
+    uint64_t *p1, *p2;
+
+    p1 = v641.access_u64();
+    p2 = v642.access_u64();
+
+    bench.run([&] {
+        for (size_t i = 0; i < v641.num_u64(); i++)
+            p1[i] &= p2[i];
+        for (size_t i = 0; i < v642.num_u64(); i++)
+            p2[i] &= p1[i];
+    });
+}
+BENCHMARK(MicroRWAnd, benchmark::PriorityLevel::HIGH);
+
+static void MicroRWOpAnd(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 1);
+    std::vector<unsigned char> v2(size, 1);
+    size_t varcost;
+
+    Val64Test v641(v1), v642(v2);
+
+    bench.run([&] {
+        Val64::op_and(v641, v642, varcost);
+        Val64::op_and(v642, v641, varcost);
+    });
+
+    /* Use it so it can't be optimized out */
+    assert(v1.empty() || memchr(v1.data(), 2, v1.size()) == nullptr);
+    assert(v2.empty() || memchr(v2.data(), 2, v2.size()) == nullptr);
+}
+BENCHMARK(MicroRWOpAnd, benchmark::PriorityLevel::HIGH);
+
+static void MicroRWAdd(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 1);
+    std::vector<unsigned char> v2(size, 1);
+
+    Val64Test v641(v1), v642(v2);
+    size_t varcost;
+
+    bench.run([&] {
+        Val64::op_add(v641, v642, varcost);
+        Val64::op_add(v642, v641, varcost);
+    });
+
+    /* Use it so it can't be optimized out */
+    if (!v1.empty()) {
+        assert(memchr(v1.data(), 1, v1.size()) == nullptr
+               || memchr(v1.data(), 1, v1.size()) != memchr(v2.data(), 1, v2.size()));
+    }
+}
+BENCHMARK(MicroRWAdd, benchmark::PriorityLevel::HIGH);
+
+static void MicroRWCopy(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 2);
+    std::vector<unsigned char> v2(size, 1);
+
+    bench.run([&] {
+        memcpy(v1.data(), v2.data(), size);
+        memcpy(v2.data(), v1.data(), size);
+    });
+
+    /* Use it so it can't be optimized out */
+    assert(v1.empty() || memchr(v1.data(), 2, v1.size()) == nullptr);
+    assert(v2.empty() || memchr(v2.data(), 2, v2.size()) == nullptr);
+}
+BENCHMARK(MicroRWCopy, benchmark::PriorityLevel::HIGH);
+
+static void MicroRWCopyManual(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 2);
+    std::vector<unsigned char> v2(size, 1);
+
+    Val64Test v641(v1), v642(v2);
+    uint64_t *p1, *p2;
+
+    p1 = v641.access_u64();
+    p2 = v642.access_u64();
+
+    bench.run([&] {
+        for (size_t i = 0; i < v641.num_u64(); i++)
+            p1[i] = p2[i];
+        for (size_t i = 0; i < v641.num_u64(); i++)
+            p2[i] = p1[i];
+    });
+
+    /* Use it so it can't be optimized out */
+    assert(v1.empty() || memchr(v1.data(), 2, v1.size()) == nullptr);
+    assert(v2.empty() || memchr(v2.data(), 2, v2.size()) == nullptr);
+}
+BENCHMARK(MicroRWCopyManual, benchmark::PriorityLevel::HIGH);
diff --git a/src/bench/val64.cpp b/src/bench/val64.cpp
new file mode 100644
index 000000000000..c8d3c7cfd42f
--- /dev/null
+++ b/src/bench/val64.cpp
@@ -0,0 +1,298 @@
+// Copyright (c) The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+#include <bench/bench.h>
+
+#include <random.h>
+#include <streams.h>
+
+#include <cstddef>
+#include <vector>
+#include <crypto/sha256.h>
+#include <script/val64.h>
+#include <util/strencodings.h>
+
+// A de-privatizing child.
+class Val64Test: public Val64 {
+public:
+    using Val64::Val64;
+    static void set_force_unaligned(bool val) { Val64::force_unaligned = val; }
+    uint64_t &last_word(size_t off = 0) { return Val64::m_u64span[m_u64span.size() - 1 - off]; }
+    const uint64_t &last_word(size_t off = 0) const { return Val64::m_u64span[m_u64span.size() - 1 - off]; }
+    std::span<le64_t> span() const { return Val64::m_u64span; }
+    std::span<le64_t> span() { return Val64::m_u64span; }
+    static void mul_span(std::span<le64_t> res,
+                         const std::span<le64_t> src,
+                         uint64_t mul) { return Val64::mul_span(res, src, mul); }
+};
+
+#define DEFAULT_BENCH_SIZE 4000000
+
+static size_t bench_size(const char *varname = "VAL64_BENCH_BYTES")
+{
+    const char *env = getenv(varname);
+    if (!env)
+        return DEFAULT_BENCH_SIZE;
+    auto val = ToIntegral<long>(env);
+    return val ? static_cast<size_t>(*val) : DEFAULT_BENCH_SIZE;
+}
+
+static void Val64UpShiftSmall(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1vec(size, 255);
+    Val64 v1(v1vec);
+    Val64 v2(1);
+    size_t n = 1;
+    size_t varcost;
+
+    bench.run([&] {
+        bool ok = Val64::op_upshift(v1, v2, size + n, varcost);
+        assert(ok);
+        n++;
+    });
+}
+BENCHMARK(Val64UpShiftSmall, benchmark::PriorityLevel::HIGH);
+
+static void Val64DownShiftSmall(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1vec(size, 255);
+    Val64 v1(v1vec);
+    Val64 v2(1);
+    size_t varcost;
+
+    bench.run([&] {
+        Val64::op_downshift(v1, v2, varcost);
+        Val64::op_downshift(v1, v2, varcost);
+    });
+}
+BENCHMARK(Val64DownShiftSmall, benchmark::PriorityLevel::HIGH);
+
+static void Val64BothShiftSmall(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1vec(size, 255);
+    Val64 v1(v1vec);
+    Val64 v2(1);
+    size_t n = 0;
+    size_t varcost;
+
+    bench.run([&] {
+        Val64::op_downshift(v1, v2, varcost);
+        bool ok = Val64::op_upshift(v1, v2, size * 2 + n, varcost);
+        assert(ok);
+        n++;
+    });
+}
+BENCHMARK(Val64BothShiftSmall, benchmark::PriorityLevel::HIGH);
+
+static void Val64BothShiftLarge(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1vec(size, 255);
+    Val64 v1(v1vec);
+    Val64 v2(size / 2 + 1);
+    size_t n = 0;
+    size_t varcost;
+
+    bench.run([&] {
+        Val64::op_downshift(v1, v2, varcost);
+        bool ok = Val64::op_upshift(v1, v2, size * 2 + n, varcost);
+        assert(ok);
+        n++;
+    });
+}
+BENCHMARK(Val64BothShiftLarge, benchmark::PriorityLevel::HIGH);
+
+static void Val64AddCarry(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 0);
+    std::vector<unsigned char> v2(size, 1);
+
+    Val64Test v641(v1), v642(v2);
+    size_t varcost;
+
+    assert(v642.last_word() == UINT64_C(0x0101010101010101));
+    bench.run([&] {
+        v641.last_word() = UINT64_MAX;
+        Val64::op_add(v641, v642, varcost);
+        v641.last_word() = UINT64_MAX;
+        Val64::op_add(v641, v642, varcost);
+        // Should not change v2!
+        assert(v642.last_word() == UINT64_C(0x0101010101010101));
+    });
+}
+BENCHMARK(Val64AddCarry, benchmark::PriorityLevel::HIGH);
+
+static void Val64AddNoCarry(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 1);
+    std::vector<unsigned char> v2(size, 1);
+
+    Val64Test v641(v1), v642(v2);
+    size_t varcost;
+
+    bench.run([&] {
+        v641.last_word() = 1;
+        Val64::op_add(v641, v642, varcost);
+        v641.last_word() = 1;
+        Val64::op_add(v641, v642, varcost);
+    });
+}
+BENCHMARK(Val64AddNoCarry, benchmark::PriorityLevel::HIGH);
+
+// This is called with various permutations, for a differential benchmark.
+// We want to see if different patterns of overflow have different performance
+// (especially can we make the branch predictions wrong?).
+//
+// There are three cases:
+// 0. Maximal overflow, as carry makes result == u1.
+// 1. Overflows normally.
+// 2. Does not overflow.
+//
+// #0 can only happen in the word after #0 or #1.
+// We use VAL64_ADD_CARRYPATTERN, and convert it into a pattern.  Not all are valid,
+// but we run them anyway (I tested 2187 through 6560 inclusive).
+//
+// The results, on my Intel Laptop, and an RPi5 were noise.
+// The RPi3 shows some differences, here are the slowest 5 and fastest 5:
+//  2443,31261722.72
+//  3405,30675625.79
+//  2676,30714874.50
+//  4404,30541586.76
+//  2286,30498973.89
+//  3243,30272764.12
+// Fastest:
+//  6396,28596129.60
+//  6477,29002149.55
+//  6068,28578248.90
+//  6560,28476473.18
+//  6478,28602590.90
+//
+// Still within 10% though.
+static void Val64AddPattern(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    const char *env = getenv("VAL64_ADD_CARRYPATTERN");
+
+    std::vector<unsigned char> template1, template2;
+
+    auto parsed = env ? ToIntegral<long>(env) : std::nullopt;
+    size_t pval = parsed ? static_cast<size_t>(*parsed) : 0;
+
+    for (size_t i = 0; i < 8; i++) {
+        switch (pval % 3) {
+        case 0:
+            template1.insert(template1.end(), 8, 1);
+            template2.insert(template2.end(), 8, 0xFF);
+            break;
+        case 1:
+            template1.insert(template1.end(), 8, 0xFF);
+            template2.insert(template2.end(), 8, 1);
+            break;
+        case 2:
+            template1.insert(template1.end(), 8, 1);
+            template2.insert(template2.end(), 8, 1);
+            break;
+        }
+        pval /= 3;
+    }
+
+    // Make sure size covers templates exactly
+    const size_t num_chunks = size / template1.size();
+    size = num_chunks * template1.size();
+    std::vector<unsigned char> v1(size);
+    std::vector<unsigned char> v2(size);
+
+    size_t varcost;
+
+    bench.run([&] {
+        v1.resize(size);
+        v2.resize(size);
+
+        for (size_t i = 0; i < num_chunks; i++) {
+            std::copy(template1.begin(), template1.end(), v1.begin() + i * template1.size());
+            std::copy(template2.begin(), template2.end(), v2.begin() + i * template1.size());
+        }
+        // Don't do final overflow!
+        v1[v1.size()-1] = 0;
+        v2[v2.size()-1] = 0;
+        Val64Test v641(v1), v642(v2);
+        // No $VAL64_ADD_CARRYPATTERN: skip actual add, to benchmark the rest of it.
+        if (env)
+            Val64::op_add(v641, v642, varcost);
+    });
+}
+BENCHMARK(Val64AddPattern, benchmark::PriorityLevel::HIGH);
+
+static void Val64SubUnderflow(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 0);
+    std::vector<unsigned char> v2(size, 0xFF);
+
+    Val64Test v641(v1);
+    const Val64Test v642(v2);
+    size_t varcost, n = 0;
+
+    bench.run([&] {
+        bool ok;
+        v641.last_word() = 0;
+        ok = Val64::op_sub(v641, v642, varcost);
+        if (ok) {
+            std::cerr << "No underflow on round " << n << " part 1" << std::endl;
+            assert(0);
+        }
+        v641.last_word() = 0;
+        ok = Val64::op_sub(v641, v642, varcost);
+        if (ok) {
+            std::cerr << "No underflow on round " << n << " part 2" << std::endl;
+            assert(0);
+        }
+        n++;
+    });
+}
+BENCHMARK(Val64SubUnderflow, benchmark::PriorityLevel::HIGH);
+
+static void Val64SubNoUnderflow(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 1);
+    std::vector<unsigned char> v2(size, 0);
+
+    Val64Test v641(v1);
+    const Val64Test v642(v2);
+    size_t varcost;
+
+    bench.run([&] {
+        Val64::op_sub(v641, v642, varcost);
+        Val64::op_sub(v641, v642, varcost);
+        // Should not change either one
+        assert(v641.last_word() == UINT64_C(0x0101010101010101));
+        assert(v642.last_word() == 0);
+    });
+}
+BENCHMARK(Val64SubNoUnderflow, benchmark::PriorityLevel::HIGH);
+
+static void Val64MulSpan(benchmark::Bench& bench)
+{
+    size_t size = bench_size();
+    std::vector<unsigned char> v1(size, 1);
+    std::vector<unsigned char> v2(size + 1);
+
+    const Val64Test v641(v1);
+    Val64Test v642(v2);
+
+    bench.run([&] {
+        Val64Test::mul_span(v642.span(), v641.span(), 1);
+        Val64Test::mul_span(v642.span(), v641.span(), 1);
+        // Should not change either one
+        assert(v641.last_word() == UINT64_C(0x0101010101010101));
+        assert(v642.last_word(1) == UINT64_C(0x0101010101010101));
+    });
+}
+BENCHMARK(Val64MulSpan, benchmark::PriorityLevel::HIGH);
diff --git a/src/bench/verify_script.cpp b/src/bench/verify_script.cpp
index 062f9a01dc2c..0d8ecaf2f808 100644
--- a/src/bench/verify_script.cpp
+++ b/src/bench/verify_script.cpp
@@ -8,6 +8,7 @@
 #include <primitives/transaction.h>
 #include <pubkey.h>
 #include <script/interpreter.h>
+#include <secp256k1/include/secp256k1.h>
 #include <script/script.h>
 #include <span.h>
 #include <test/util/transaction_utils.h>
@@ -87,5 +88,68 @@ static void VerifyNestedIfScript(benchmark::Bench& bench)
     });
 }
 
+
+static void VerifySchnorr(benchmark::Bench& bench)
+{
+    KeyPair::ECC_Start();
+
+    // Key pair.
+    CKey key;
+    static const std::array<unsigned char, 32> vchKey = {
+        {
+            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1
+        }
+    };
+    key.Set(vchKey.begin(), vchKey.end(), false);
+    CPubKey pubkey = key.GetPubKey();
+
+    std::vector<unsigned char> vchSig(64);
+    const uint256 hash = uint256::ONE;
+    key.SignSchnorr(hash, vchSig, nullptr, hash);
+
+    XOnlyPubKey xpub(pubkey);
+    std::span<const unsigned char> sigbytes(vchSig.data(), vchSig.size());
+    assert(sigbytes.size() == 64);
+
+    // Benchmark.
+    bench.run([&] {
+        bool res = xpub.VerifySchnorr(hash, sigbytes);
+        assert(res);
+    });
+    KeyPair::ECC_Stop();
+}
+
+static void VerifyTweakAdd(benchmark::Bench& bench)
+{
+    KeyPair::ECC_Start();
+
+    // To be a fair test, the tweak and pubkey have to start serialized
+    const unsigned char tweak[] = {
+        1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32
+    };
+
+    std::array<unsigned char, 33> key = {
+        {
+            0x02, 0xba, 0xd0, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x59, 0x92, 0xd9, 0x5d, 0x9a, 0x0d, 0x20, 0x64, 0x76, 0xe5, 0xcd, 0x22, 0x8d, 0xb1, 0xe6, 0x9e, 0x87, 0x1e, 0x18, 0x13, 0x12, 0xe5, 0x8e, 0x17, 0x9e,
+        }
+    };
+
+    bool res;
+    secp256k1_pubkey pubkey;
+
+    res = secp256k1_ec_pubkey_parse(secp256k1_context_static, &pubkey,
+                                    key.data(), key.size());
+    assert(res);
+
+    // Benchmark.
+    bench.run([&] {
+        res = secp256k1_ec_pubkey_tweak_add(secp256k1_context_static, &pubkey, tweak);
+        assert(res);
+    });
+    KeyPair::ECC_Stop();
+}
+
 BENCHMARK(VerifyScriptBench, benchmark::PriorityLevel::HIGH);
 BENCHMARK(VerifyNestedIfScript, benchmark::PriorityLevel::HIGH);
+BENCHMARK(VerifySchnorr, benchmark::PriorityLevel::HIGH);
+BENCHMARK(VerifyTweakAdd, benchmark::PriorityLevel::HIGH);
diff --git a/src/bitcoin-util.cpp b/src/bitcoin-util.cpp
index ae76050c300c..8c0b1e98accd 100644
--- a/src/bitcoin-util.cpp
+++ b/src/bitcoin-util.cpp
@@ -179,6 +179,7 @@ static std::string sigver2str(SigVersion sigver)
     case SigVersion::WITNESS_V0: return "witness_v0";
     case SigVersion::TAPROOT: return "taproot";
     case SigVersion::TAPSCRIPT: return "tapscript";
+    case SigVersion::TAPSCRIPT_V2: return "tapscript_v2";
     }
     return "unknown";
 }
@@ -369,7 +370,7 @@ static int EvalScript(const ArgsManager& argsman, const std::vector<std::string>
 
     std::optional<bool> opsuccess_check;
     if (sigversion == SigVersion::TAPSCRIPT) {
-        opsuccess_check = CheckTapscriptOpSuccess(script, flags, &serror);
+        opsuccess_check = CheckTapscriptOpSuccess(script, flags, sigversion, &serror, std::nullopt);
     }
 
     bool success = (opsuccess_check.has_value() ? *opsuccess_check : EvalScript(stack, script, flags, *Assert(checker), sigversion, execdata, &serror));
diff --git a/src/kernel/CMakeLists.txt b/src/kernel/CMakeLists.txt
index fd0768b92f52..19931d9d3da9 100644
--- a/src/kernel/CMakeLists.txt
+++ b/src/kernel/CMakeLists.txt
@@ -53,6 +53,8 @@ add_library(bitcoinkernel
   ../script/script_error.cpp
   ../script/sigcache.cpp
   ../script/solver.cpp
+  ../script/val64.cpp
+  ../script/valtype_stack.cpp
   ../signet.cpp
   ../streams.cpp
   ../support/lockedpool.cpp
diff --git a/src/key.cpp b/src/key.cpp
index 360a1f46d3fb..3a0daf3c2a8f 100644
--- a/src/key.cpp
+++ b/src/key.cpp
@@ -446,7 +446,7 @@ bool ECC_InitSanityCheck() {
 }
 
 /** Initialize the elliptic curve support. May not be called twice without calling ECC_Stop first. */
-static void ECC_Start() {
+void KeyPair::ECC_Start() {
     assert(secp256k1_context_sign == nullptr);
 
     secp256k1_context *ctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
@@ -464,7 +464,7 @@ static void ECC_Start() {
 }
 
 /** Deinitialize the elliptic curve support. No-op if ECC_Start wasn't called first. */
-static void ECC_Stop() {
+void KeyPair::ECC_Stop() {
     secp256k1_context *ctx = secp256k1_context_sign;
     secp256k1_context_sign = nullptr;
 
@@ -475,10 +475,10 @@ static void ECC_Stop() {
 
 ECC_Context::ECC_Context()
 {
-    ECC_Start();
+    KeyPair::ECC_Start();
 }
 
 ECC_Context::~ECC_Context()
 {
-    ECC_Stop();
+    KeyPair::ECC_Stop();
 }
diff --git a/src/key.h b/src/key.h
index 6ed6fd0fc3da..7b7a5d511722 100644
--- a/src/key.h
+++ b/src/key.h
@@ -291,6 +291,9 @@ class KeyPair
     //! Check whether this keypair is valid.
     bool IsValid() const { return !!m_keypair; }
 
+    static void ECC_Start();
+    static void ECC_Stop();
+
 private:
     KeyPair(const CKey& key, const uint256* merkle_root);
 
diff --git a/src/policy/policy.cpp b/src/policy/policy.cpp
index 994e67978622..d8a287f1bf89 100644
--- a/src/policy/policy.cpp
+++ b/src/policy/policy.cpp
@@ -331,6 +331,11 @@ bool IsWitnessStandard(const CTransaction& tx, const CCoinsViewCache& mapInputs)
                     for (const auto& item : stack) {
                         if (item.size() > MAX_STANDARD_TAPSCRIPT_STACK_ITEM_SIZE) return false;
                     }
+                } else if ((control_block[0] & TAPROOT_LEAF_MASK) == TAPROOT_LEAF_TAPSCRIPT_V2) {
+                    // Leaf version 0xc2 (aka Tapscript v2)
+                    for (const auto& item : stack) {
+                        if (item.size() > MAX_STANDARD_TAPSCRIPT_V2_STACK_ITEM_SIZE) return false;
+                    }
                 }
             } else if (stack.size() == 1) {
                 // Key path spend (1 stack element after removing optional annex)
diff --git a/src/policy/policy.h b/src/policy/policy.h
index b93137e54aaa..2dfe96cd4854 100644
--- a/src/policy/policy.h
+++ b/src/policy/policy.h
@@ -53,6 +53,7 @@ static constexpr unsigned int MAX_STANDARD_P2WSH_STACK_ITEMS{100};
 static constexpr unsigned int MAX_STANDARD_P2WSH_STACK_ITEM_SIZE{80};
 /** The maximum size in bytes of each witness stack item in a standard BIP 342 script (Taproot, leaf version 0xc0) */
 static constexpr unsigned int MAX_STANDARD_TAPSCRIPT_STACK_ITEM_SIZE{80};
+static constexpr unsigned int MAX_STANDARD_TAPSCRIPT_V2_STACK_ITEM_SIZE{4000000}; // 4MB
 /** The maximum size in bytes of a standard witnessScript */
 static constexpr unsigned int MAX_STANDARD_P2WSH_SCRIPT_SIZE{3600};
 /** The maximum size of a standard ScriptSig */
diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index 0e67b9940c99..73a039a9381e 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -12,6 +12,8 @@
 #include <pubkey.h>
 #include <script/script.h>
 #include <tinyformat.h>
+#include <script/valtype_stack.h>
+#include <script/val64.h>
 #include <uint256.h>
 
 typedef std::vector<unsigned char> valtype;
@@ -62,6 +64,26 @@ static inline void popstack(std::vector<valtype>& stack)
     stack.pop_back();
 }
 
+static inline void popstack(ValtypeStack& stack)
+{
+    if (stack.empty())
+        throw std::runtime_error("popstack(ValtypeStack& stack): stack empty");
+    stack.pop_back();
+}
+
+static void pushVal64(ValtypeStack& stack, Val64 &v)
+{
+    stack.push_back(v.move_to_valtype());
+}
+
+static void stackPushCosted(ValtypeStack& stack,
+                              const std::vector<unsigned char> &v,
+                              size_t &varcost)
+{
+    varcost += v.size();
+    stack.push_back(v);
+}
+
 bool static IsCompressedOrUncompressedPubKey(const valtype &vchPubKey) {
     if (vchPubKey.size() < CPubKey::COMPRESSED_SIZE) {
         //  Non-canonical public key: too short
@@ -347,7 +369,7 @@ static bool EvalChecksigPreTapscript(const valtype& vchSig, const valtype& vchPu
 
 static bool EvalChecksigTapscript(const valtype& sig, const valtype& pubkey, ScriptExecutionData& execdata, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* serror, bool& success)
 {
-    assert(sigversion == SigVersion::TAPSCRIPT);
+    assert(sigversion == SigVersion::TAPSCRIPT || sigversion == SigVersion::TAPSCRIPT_V2);
     assert(execdata.m_internal_key); // caller must provide the internal key
 
     /*
@@ -357,7 +379,7 @@ static bool EvalChecksigTapscript(const valtype& sig, const valtype& pubkey, Scr
      *    the script execution fails when using non-empty invalid signature.
      */
     success = !sig.empty();
-    if (success) {
+    if (success && sigversion == SigVersion::TAPSCRIPT) {
         // Implement the sigops/witnesssize ratio test.
         // Passing with an upgradable public key version is also counted.
         assert(execdata.m_validation_weight_left_init);
@@ -412,6 +434,7 @@ static bool EvalChecksig(const valtype& sig, const valtype& pubkey, CScript::con
     case SigVersion::WITNESS_V0:
         return EvalChecksigPreTapscript(sig, pubkey, pbegincodehash, pend, flags, checker, sigversion, serror, success);
     case SigVersion::TAPSCRIPT:
+    case SigVersion::TAPSCRIPT_V2:
         return EvalChecksigTapscript(sig, pubkey, execdata, flags, checker, sigversion, serror, success);
     case SigVersion::TAPROOT:
         // Key path spending in Taproot has no script, so this is unreachable.
@@ -1397,175 +1420,1203 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
     return set_success(serror);
 }
 
-bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* serror)
+
+bool EvalGsrScript(ValtypeStack& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptExecutionData& execdata, uint64_t& varops_budget, ScriptError* serror)
 {
-    ScriptExecutionData execdata;
-    return EvalScript(stack, script, flags, checker, sigversion, execdata, serror);
-}
+    static const CScriptNum bnZero(0);
+    static const CScriptNum bnOne(1);
+    static const valtype vchFalse(0);
+    static const valtype vchTrue(1, 1);
 
-namespace {
+    // sigversion can only be TAPSCRIPT_V2 here
+    assert(sigversion == SigVersion::TAPSCRIPT_V2);
 
-/**
- * Wrapper that serializes like CTransaction, but with the modifications
- *  required for the signature hash done in-place
- */
-template <class T>
-class CTransactionSignatureSerializer
-{
-private:
-    const T& txTo;             //!< reference to the spending transaction (the one being serialized)
-    const CScript& scriptCode; //!< output script being consumed
-    const unsigned int nIn;    //!< input index of txTo being signed
-    const bool fAnyoneCanPay;  //!< whether the hashtype has the SIGHASH_ANYONECANPAY flag set
-    const bool fHashSingle;    //!< whether the hashtype is SIGHASH_SINGLE
-    const bool fHashNone;      //!< whether the hashtype is SIGHASH_NONE
+    CScript::const_iterator pc = script.begin();
+    CScript::const_iterator pend = script.end();
+    CScript::const_iterator pbegincodehash = script.begin();
+    opcodetype opcode;
+    valtype vchPushValue;
+    ConditionStack vfExec;
+    ValtypeStack altstack;
+    set_error(serror, SCRIPT_ERR_UNKNOWN_ERROR);
+    bool fRequireMinimal = (flags & SCRIPT_VERIFY_MINIMALDATA) != 0;
+    uint32_t opcode_pos = 0;
+    execdata.m_codeseparator_pos = 0xFFFFFFFFUL;
+    execdata.m_codeseparator_pos_init = true;
 
-public:
-    CTransactionSignatureSerializer(const T& txToIn, const CScript& scriptCodeIn, unsigned int nInIn, int nHashTypeIn) :
-        txTo(txToIn), scriptCode(scriptCodeIn), nIn(nInIn),
-        fAnyoneCanPay(!!(nHashTypeIn & SIGHASH_ANYONECANPAY)),
-        fHashSingle((nHashTypeIn & 0x1f) == SIGHASH_SINGLE),
-        fHashNone((nHashTypeIn & 0x1f) == SIGHASH_NONE) {}
+    try
+    {
+        for (; pc < pend; ++opcode_pos) {
+            bool fExec = vfExec.all_true();
+            size_t varcost = 0;
 
-    /** Serialize the passed scriptCode, skipping OP_CODESEPARATORs */
-    template<typename S>
-    void SerializeScriptCode(S &s) const {
-        CScript::const_iterator it = scriptCode.begin();
-        CScript::const_iterator itBegin = it;
-        opcodetype opcode;
-        unsigned int nCodeSeparators = 0;
-        while (scriptCode.GetOp(it, opcode)) {
-            if (opcode == OP_CODESEPARATOR)
-                nCodeSeparators++;
-        }
-        ::WriteCompactSize(s, scriptCode.size() - nCodeSeparators);
-        it = itBegin;
-        while (scriptCode.GetOp(it, opcode)) {
-            if (opcode == OP_CODESEPARATOR) {
-                s.write(AsBytes(Span{&itBegin[0], size_t(it - itBegin - 1)}));
-                itBegin = it;
-            }
-        }
-        if (itBegin != scriptCode.end())
-            s.write(AsBytes(Span{&itBegin[0], size_t(it - itBegin)}));
-    }
+            //
+            // Read instruction
+            //
+            if (!script.GetOp(pc, opcode, vchPushValue))
+                return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+            if (vchPushValue.size() > MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE)
+                return set_error(serror, SCRIPT_ERR_PUSH_SIZE);
 
-    /** Serialize an input of txTo */
-    template<typename S>
-    void SerializeInput(S &s, unsigned int nInput) const {
-        // In case of SIGHASH_ANYONECANPAY, only the input being signed is serialized
-        if (fAnyoneCanPay)
-            nInput = nIn;
-        // Serialize the prevout
-        ::Serialize(s, txTo.vin[nInput].prevout);
-        // Serialize the script
-        if (nInput != nIn)
-            // Blank out other inputs' signatures
-            ::Serialize(s, CScript());
-        else
-            SerializeScriptCode(s);
-        // Serialize the nSequence
-        if (nInput != nIn && (fHashSingle || fHashNone))
-            // let the others update at will
-            ::Serialize(s, int32_t{0});
-        else
-            ::Serialize(s, txTo.vin[nInput].nSequence);
-    }
+            if (fExec && 0 <= opcode && opcode <= OP_PUSHDATA4) {
+                if (fRequireMinimal && !CheckMinimalPush(vchPushValue, opcode)) {
+                    return set_error(serror, SCRIPT_ERR_MINIMALDATA);
+                }
+                stack.push_back(vchPushValue);
+            } else if (fExec || (OP_IF <= opcode && opcode <= OP_ENDIF))
+            switch (opcode)
+            {
+                //
+                // Push value
+                //
+                case OP_1NEGATE:
+                case OP_1:
+                case OP_2:
+                case OP_3:
+                case OP_4:
+                case OP_5:
+                case OP_6:
+                case OP_7:
+                case OP_8:
+                case OP_9:
+                case OP_10:
+                case OP_11:
+                case OP_12:
+                case OP_13:
+                case OP_14:
+                case OP_15:
+                case OP_16:
+                {
+                    // OP_1NEGATE is OP_SUCCESS in Tapscript2
+                    if (opcode == OP_1NEGATE) {
+                        break;
+                    }
+                    // ( -- value)
+                    CScriptNum bn((int)opcode - (int)(OP_1 - 1));
+                    stack.push_back(bn.getvch());
+                    // The result of these opcodes should always be the minimal way to push the data
+                    // they push, so no need for a CheckMinimalPush here.
+                }
+                break;
 
-    /** Serialize an output of txTo */
-    template<typename S>
-    void SerializeOutput(S &s, unsigned int nOutput) const {
-        if (fHashSingle && nOutput != nIn)
-            // Do not lock-in the txout payee at other indices as txin
-            ::Serialize(s, CTxOut());
-        else
-            ::Serialize(s, txTo.vout[nOutput]);
-    }
 
-    /** Serialize txTo */
-    template<typename S>
-    void Serialize(S &s) const {
-        // Serialize version
-        ::Serialize(s, txTo.version);
-        // Serialize vin
-        unsigned int nInputs = fAnyoneCanPay ? 1 : txTo.vin.size();
-        ::WriteCompactSize(s, nInputs);
-        for (unsigned int nInput = 0; nInput < nInputs; nInput++)
-             SerializeInput(s, nInput);
-        // Serialize vout
-        unsigned int nOutputs = fHashNone ? 0 : (fHashSingle ? nIn+1 : txTo.vout.size());
-        ::WriteCompactSize(s, nOutputs);
-        for (unsigned int nOutput = 0; nOutput < nOutputs; nOutput++)
-             SerializeOutput(s, nOutput);
-        // Serialize nLockTime
-        ::Serialize(s, txTo.nLockTime);
-    }
-};
+                //
+                // Control
+                //
+                case OP_NOP:
+                    break;
 
-/** Compute the (single) SHA256 of the concatenation of all prevouts of a tx. */
-template <class T>
-uint256 GetPrevoutsSHA256(const T& txTo)
-{
-    HashWriter ss{};
-    for (const auto& txin : txTo.vin) {
-        ss << txin.prevout;
-    }
-    return ss.GetSHA256();
-}
+                case OP_CHECKLOCKTIMEVERIFY:
+                {
+                    if (!(flags & SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY)) {
+                        // not enabled; treat as a NOP2
+                        break;
+                    }
 
-/** Compute the (single) SHA256 of the concatenation of all nSequences of a tx. */
-template <class T>
-uint256 GetSequencesSHA256(const T& txTo)
-{
-    HashWriter ss{};
-    for (const auto& txin : txTo.vin) {
-        ss << txin.nSequence;
-    }
-    return ss.GetSHA256();
-}
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 
-/** Compute the (single) SHA256 of the concatenation of all txouts of a tx. */
-template <class T>
-uint256 GetOutputsSHA256(const T& txTo)
-{
-    HashWriter ss{};
-    for (const auto& txout : txTo.vout) {
-        ss << txout;
-    }
-    return ss.GetSHA256();
-}
+                    CScriptNum nLockTime(0);
 
-/** Compute the (single) SHA256 of the concatenation of all amounts spent by a tx. */
-uint256 GetSpentAmountsSHA256(const std::vector<CTxOut>& outputs_spent)
-{
-    HashWriter ss{};
-    for (const auto& txout : outputs_spent) {
-        ss << txout.nValue;
+                    Val64 v;
+                    if (!stack.pop64(v)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    // 32 bit limit: anything greater is an equivalent
+                    // "always fail".
+                    int64_t nl = v.to_u64_ceil(UINT64_C(0x100000000), varcost);
+                    nLockTime = CScriptNum(nl);
+                    stack.push_back(v.move_to_valtype());
 
-    }
-    return ss.GetSHA256();
-}
+                    // Actually compare the specified lock time with the transaction.
+                    if (!checker.CheckLockTime(nLockTime))
+                        return set_error(serror, SCRIPT_ERR_UNSATISFIED_LOCKTIME);
 
-/** Compute the (single) SHA256 of the concatenation of all scriptSigs in a tx. */
-template <class T>
-uint256 GetScriptSigsSHA256(const T& txTo)
-{
-    HashWriter ss{};
-    for (const auto& in : txTo.vin) {
-        ss << in.scriptSig;
-    }
-    return ss.GetSHA256();
-}
+                    break;
+                }
 
-/** Compute the (single) SHA256 of the concatenation of all scriptPubKeys spent by a tx. */
-uint256 GetSpentScriptsSHA256(const std::vector<CTxOut>& outputs_spent)
-{
-    HashWriter ss{};
-    for (const auto& txout : outputs_spent) {
-        ss << txout.scriptPubKey;
-    }
-    return ss.GetSHA256();
-}
+                case OP_CHECKSEQUENCEVERIFY:
+                {
+                    if (!(flags & SCRIPT_VERIFY_CHECKSEQUENCEVERIFY)) {
+                        // not enabled; treat as a NOP3
+                        break;
+                    }
+
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    // nSequence, like nLockTime, is a 32-bit unsigned integer
+                    // field. See the comment in CHECKLOCKTIMEVERIFY regarding
+                    // 5-byte numeric operands.
+                    CScriptNum nSequence(0);
+
+                    Val64 v;
+                    if (!stack.pop64(v)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    // 32 bit limit: anything greater is an equivalent
+                    // "always fail".
+                    int64_t ns = v.to_u64_ceil(UINT64_C(0x100000000), varcost);
+                    nSequence = CScriptNum(ns);
+                    stack.push_back(v.move_to_valtype());
+
+                    // In the rare event that the argument may be < 0 due to
+                    // some arithmetic being done first, you can always use
+                    // 0 MAX CHECKSEQUENCEVERIFY.
+                    if (nSequence < 0)
+                        return set_error(serror, SCRIPT_ERR_NEGATIVE_LOCKTIME);
+
+                    // To provide for future soft-fork extensibility, if the
+                    // operand has the disabled lock-time flag set,
+                    // CHECKSEQUENCEVERIFY behaves as a NOP.
+                    if ((nSequence & CTxIn::SEQUENCE_LOCKTIME_DISABLE_FLAG) != 0)
+                        break;
+
+                    // Compare the specified sequence number with the input.
+                    if (!checker.CheckSequence(nSequence))
+                        return set_error(serror, SCRIPT_ERR_UNSATISFIED_LOCKTIME);
+
+                    break;
+                }
+
+                case OP_NOP1: case OP_NOP4: case OP_NOP5:
+                case OP_NOP6: case OP_NOP7: case OP_NOP8: case OP_NOP9: case OP_NOP10:
+                {
+                    if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS)
+                        return set_error(serror, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS);
+                }
+                break;
+
+                case OP_IF:
+                case OP_NOTIF:
+                {
+                    // <expression> if [statements] [else [statements]] endif
+                    bool fValue = false;
+                    if (fExec)
+                    {
+                        if (stack.size() < 1)
+                            return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
+                        const valtype& vch = stacktop(-1);
+                        // Tapscript requires minimal IF/NOTIF inputs as a consensus rule.
+                        // The input argument to the OP_IF and OP_NOTIF opcodes must be either
+                        // exactly 0 (the empty vector) or exactly 1 (the one-byte vector with value 1).
+                        if (vch.size() > 1 || (vch.size() == 1 && vch[0] != 1)) {
+                            return set_error(serror, SCRIPT_ERR_TAPSCRIPT_MINIMALIF);
+                        }
+                        fValue = CastToBool(vch);
+                        if (opcode == OP_NOTIF)
+                            fValue = !fValue;
+                        popstack(stack);
+                    }
+                    vfExec.push_back(fValue);
+                }
+                break;
+
+                case OP_ELSE:
+                {
+                    if (vfExec.empty())
+                        return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
+                    vfExec.toggle_top();
+                }
+                break;
+
+                case OP_ENDIF:
+                {
+                    if (vfExec.empty())
+                        return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
+                    vfExec.pop_back();
+                }
+                break;
+
+                case OP_VERIFY:
+                {
+                    // (true -- ) or
+                    // (false -- false) and return
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    Val64 v;
+                    if (!stack.pop64(v)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    if (v.to_u64_ceil(1, varcost) == 0)
+                        return set_error(serror, SCRIPT_ERR_VERIFY);
+                }
+                break;
+
+                case OP_RETURN:
+                {
+                    return set_error(serror, SCRIPT_ERR_OP_RETURN);
+                }
+                break;
+
+
+                //
+                // Stack ops
+                //
+                case OP_TOALTSTACK:
+                {
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    altstack.push_back(stack.pop_back_valtype());
+                }
+                break;
+
+                case OP_FROMALTSTACK:
+                {
+                    if (altstack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_ALTSTACK_OPERATION);
+                    stack.push_back(altstack.pop_back_valtype());
+                }
+                break;
+
+                case OP_2DROP:
+                {
+                    // (x1 x2 -- )
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    popstack(stack);
+                    popstack(stack);
+                }
+                break;
+
+                case OP_2DUP:
+                {
+                    // (x1 x2 -- x1 x2 x1 x2)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    // Keep safe with references
+                    stack.reserve(stack.size() + 2);
+                    const valtype &vch1 = stacktop(-2);
+                    const valtype &vch2 = stacktop(-1);
+                    // BIP#ops:
+                    // |OP_2DUP
+                    // |Sum of two operand lengths (COPYING)
+                    stackPushCosted(stack, vch1, varcost);
+                    stackPushCosted(stack, vch2, varcost);
+                }
+                break;
+
+                case OP_3DUP:
+                {
+                    // (x1 x2 x3 -- x1 x2 x3 x1 x2 x3)
+                    if (stack.size() < 3)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    // Keep safe with references
+                    stack.reserve(stack.size() + 3);
+                    const valtype &vch1 = stacktop(-3);
+                    const valtype &vch2 = stacktop(-2);
+                    const valtype &vch3 = stacktop(-1);
+                    // BIP#ops:
+                    // |OP_3DUP
+                    // |Sum of three operand lengths (COPYING)
+                    stackPushCosted(stack, vch1, varcost);
+                    stackPushCosted(stack, vch2, varcost);
+                    stackPushCosted(stack, vch3, varcost);
+                }
+                break;
+                case OP_2OVER:
+                {
+                    // (x1 x2 x3 x4 -- x1 x2 x3 x4 x1 x2)
+                    if (stack.size() < 4)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    // Keep safe with references
+                    stack.reserve(stack.size() + 2);
+                    const valtype &vch1 = stacktop(-4);
+                    const valtype &vch2 = stacktop(-3);
+                    // BIP#ops:
+                    // |OP_2OVER
+                    // |Sum of lengths of third and fourth-top stack entries (before) (COPYING)
+                    stackPushCosted(stack, vch1, varcost);
+                    stackPushCosted(stack, vch2, varcost);
+                }
+                break;
+
+                case OP_2ROT:
+                {
+                    // (x1 x2 x3 x4 x5 x6 -- x3 x4 x5 x6 x1 x2)
+                    if (stack.size() < 6)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.rotate(-6, -4, 0);
+                }
+                break;
+
+                case OP_2SWAP:
+                {
+                    // (x1 x2 x3 x4 -- x3 x4 x1 x2)
+                    if (stack.size() < 4)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.swap(-4, -2);
+                    stack.swap(-3, -1);
+                }
+                break;
+
+                case OP_IFDUP:
+                {
+                    // (x - 0 | x x)
+                    Val64 v64;
+                    if (!stack.pop64(v64))
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    bool result = !v64.is_zero(varcost);
+                    std::vector<unsigned char> vch(v64.move_to_valtype());
+                    // BIP#ops:
+                    // |OP_IFDUP
+                    // |(Length of top stack entry (before)) * 2 (COMPARINGZERO + COPYING)
+                    varcost += vch.size();
+                    if (result)
+                        stack.push_back(vch);
+                    stack.push_back(std::move(vch));
+                }
+                break;
+
+                case OP_DEPTH:
+                {
+                    // -- stacksize
+                    Val64 v(stack.size());
+                    valtype vch = v.move_to_valtype();
+                    stackPushCosted(stack, vch, varcost);
+                }
+                break;
+
+                case OP_DROP:
+                {
+                    // (x -- )
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    popstack(stack);
+                }
+                break;
+
+                case OP_DUP:
+                {
+                    // (x -- x x)
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    // Keep safe with references
+                    stack.reserve(stack.size() + 1);
+                    const valtype &vch = stacktop(-1);
+                    // BIP#ops:
+                    // |OP_DUP
+                    // |Length of top stack entry (before) (COPYING)
+                    stackPushCosted(stack, vch, varcost);
+                }
+                break;
+
+                case OP_NIP:
+                {
+                    // (x1 x2 -- x2)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.erase(stack.size() - 2);
+                }
+                break;
+
+                case OP_OVER:
+                {
+                    // (x1 x2 -- x1 x2 x1)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    // Keep safe with references
+                    stack.reserve(stack.size() + 1);
+                    const valtype &vch = stacktop(-2);
+                    // BIP#ops:
+                    // |OP_OVER
+                    // |Length of second-top stack entry (before) (COPYING)
+                    stackPushCosted(stack, vch, varcost);
+                }
+                break;
+
+                case OP_PICK:
+                case OP_ROLL:
+                {
+                    // (xn ... x2 x1 x0 n - xn ... x2 x1 x0 xn)
+                    // (xn ... x2 x1 x0 n - ... x2 x1 x0 xn)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    Val64 v;
+                    if (!stack.pop64(v)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+
+                    // BIP#ops:
+                    // |OP_ROLL
+                    // |Length of top stack entry (LENGTHCONV)
+
+                    // BIP#ops:
+                    // |OP_PICK
+                    // |Length of top stack entry + Length of N-th-from-top stack entry (before) (LENGTHCONV + COPYING)
+                    int n = v.to_u64_ceil(stack.size(), varcost);
+                    if (n < 0 || n >= static_cast<int>(stack.size()))
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    if (opcode == OP_ROLL) {
+                        stack.roll(n);
+                        varcost += n * 24;
+                    } else {
+                        // Keep safe with references
+                        stack.reserve(stack.size() + 1);
+                        const valtype &vch = stacktop(-n-1);
+                        stackPushCosted(stack, vch, varcost);
+                    }
+                }
+                break;
+
+                case OP_ROT:
+                {
+                    // (x1 x2 x3 -- x2 x3 x1)
+                    if (stack.size() < 3)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.rotate(-3, -2, 0);
+                }
+                break;
+
+                case OP_SWAP:
+                {
+                    // (x1 x2 -- x2 x1)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    stack.swap(-2, -1);
+                }
+                break;
+
+                case OP_TUCK:
+                {
+                    // (x1 x2 -- x2 x1 x2)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    // Keep safe with references
+                    stack.reserve(stack.size() + 1);
+                    const valtype &vch = stacktop(-1);
+                    // BIP#ops:
+                    // |OP_TUCK
+                    // |Length of second-from-top stack entry (before) (COPYING)
+                    varcost += vch.size();
+                    // (x1 x2) -> push x2 -> (x1 x2 x2) -> swap(-2,-3) -> (x2 x1 x2)
+                    stack.push_back(vch);
+                    stack.swap(-2, -3);
+                }
+                break;
+
+
+                case OP_SIZE:
+                {
+                    // (in -- in size)
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    Val64 v(stacktop(-1).size());
+                    valtype vch = v.move_to_valtype();
+                    stackPushCosted(stack, vch, varcost);
+                }
+                break;
+
+
+                //
+                // Bitwise logic
+                //
+                case OP_EQUAL:
+                case OP_EQUALVERIFY:
+                //case OP_NOTEQUAL: // use OP_NUMNOTEQUAL
+                {
+                    // (x1 x2 - bool)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    const valtype& vch1 = stacktop(-2);
+                    const valtype& vch2 = stacktop(-1);
+                    bool fEqual = (vch1 == vch2);
+                    // OP_NOTEQUAL is disabled because it would be too easy to say
+                    // something like n != 1 and have some wiseguy pass in 1 with extra
+                    // zero bytes after it (numerically, 0x01 == 0x0001 == 0x000001)
+                    //if (opcode == OP_NOTEQUAL)
+                    //    fEqual = !fEqual;
+                    if (vch1.size() == vch2.size()) {
+                        varcost += vch1.size();
+                    }
+                    popstack(stack);
+                    popstack(stack);
+                    stack.push_back(fEqual ? vchTrue : vchFalse);
+                    if (opcode == OP_EQUALVERIFY)
+                    {
+                        if (fEqual)
+                            popstack(stack);
+                        else
+                            return set_error(serror, SCRIPT_ERR_EQUALVERIFY);
+                    }
+                }
+                break;
+
+
+                //
+                // Numeric
+                //
+                case OP_1ADD:
+                case OP_1SUB:
+                case OP_NEGATE:
+                case OP_ABS:
+                case OP_NOT:
+                case OP_0NOTEQUAL:
+                {
+                    // OP_NEGATE and OP_ABS are OP_SUCCESS in Tapscript2
+                    if (opcode == OP_NEGATE || opcode == OP_ABS)
+                        break;
+                    Val64 v64;
+                    if (!stack.pop64(v64))
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    switch (opcode)
+                    {
+                    case OP_1ADD:
+                        Val64::op_1add(v64, varcost);
+                        break;
+                    case OP_1SUB:
+                        if (!Val64::op_1sub(v64, varcost))
+                            return set_error(serror, SCRIPT_ERR_SUB_UNDERFLOW);
+                        break;
+                    case OP_NOT:
+                        v64 = Val64(v64.is_zero(varcost) ? 1 : 0);
+                        break;
+                    case OP_0NOTEQUAL:
+                        v64 = Val64(v64.is_zero(varcost) ? 0 : 1);
+                        break;
+                    default:
+                        assert(!"invalid opcode");
+                        break;
+                    }
+                    pushVal64(stack, v64);
+                }
+                break;
+
+                case OP_ADD:
+                case OP_SUB:
+                case OP_BOOLAND:
+                case OP_BOOLOR:
+                case OP_NUMEQUAL:
+                case OP_NUMEQUALVERIFY:
+                case OP_NUMNOTEQUAL:
+                case OP_LESSTHAN:
+                case OP_GREATERTHAN:
+                case OP_LESSTHANOREQUAL:
+                case OP_GREATERTHANOREQUAL:
+                case OP_MIN:
+                case OP_MAX:
+                {
+                    Val64 v1, v2;
+                    if (!stack.pop64(v2) || !stack.pop64(v1)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    // These place result into v1.
+                    switch (opcode) {
+                    case OP_ADD:
+                        Val64::op_add(v1, v2, varcost);
+                        break;
+
+                    case OP_SUB:
+                        if (!Val64::op_sub(v1, v2, varcost))
+                            return set_error(serror, SCRIPT_ERR_SUB_UNDERFLOW);
+                        break;
+                    case OP_BOOLAND:
+                        // Careful: evaluate both is_zero calls before combining to avoid short-circuiting
+                        {
+                            bool z1 = v1.is_zero(varcost);
+                            bool z2 = v2.is_zero(varcost);
+                            v1 = Val64(!z1 && !z2);
+                        }
+                        break;
+                    case OP_BOOLOR:
+                        // Careful: evaluate both is_zero calls before combining to avoid short-circuiting
+                        {
+                            bool z1 = v1.is_zero(varcost);
+                            bool z2 = v2.is_zero(varcost);
+                            v1 = Val64(!z1 || !z2);
+                        }
+                        break;
+                    case OP_NUMEQUAL:
+                        v1 = Val64(v1.cmp(v2, varcost) == 0 ? 1 : 0);
+                        break;
+                    case OP_NUMEQUALVERIFY:
+                        if (v1.cmp(v2, varcost) != 0)
+                            return set_error(serror, SCRIPT_ERR_NUMEQUALVERIFY);
+                        v1 = Val64(1);
+                        break;
+                    case OP_NUMNOTEQUAL:
+                        v1 = Val64(v1.cmp(v2, varcost) == 0 ? 0 : 1);
+                        break;
+                    case OP_LESSTHAN:
+                        v1 = Val64(v1.cmp(v2, varcost) < 0 ? 1 : 0);
+                        break;
+                    case OP_GREATERTHAN:
+                        v1 = Val64(v1.cmp(v2, varcost) > 0 ? 1 : 0);
+                        break;
+                    case OP_LESSTHANOREQUAL:
+                        v1 = Val64(v1.cmp(v2, varcost) <= 0 ? 1 : 0);
+                        break;
+                    case OP_GREATERTHANOREQUAL:
+                        v1 = Val64(v1.cmp(v2, varcost) >= 0 ? 1 : 0);
+                        break;
+                    case OP_MIN:
+                        Val64::op_min(v1, v2, varcost);
+                        break;
+                    case OP_MAX:
+                        Val64::op_max(v1, v2, varcost);
+                        break;
+                    default:
+                        assert(!"invalid opcode"); break;
+                    }
+                    if (opcode != OP_NUMEQUALVERIFY) {
+                        pushVal64(stack, v1);
+                    }
+                    break;
+                }
+                case OP_WITHIN:
+                    {
+                    Val64 v1, v2, v3;
+                    if (!stack.pop64(v3) ||
+                        !stack.pop64(v2) ||
+                        !stack.pop64(v1)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    // Careful: evaluate both cmp calls before combining to avoid short-circuiting
+                    bool cond1 = v1.cmp(v2, varcost) >= 0;
+                    bool cond2 = v1.cmp(v3, varcost) < 0;
+                    Val64 res = Val64((cond1 && cond2) ? 1 : 0);
+                    pushVal64(stack, res);
+                    }
+                break;
+
+
+                //
+                // Crypto
+                //
+                case OP_RIPEMD160:
+                case OP_SHA1:
+                case OP_SHA256:
+                case OP_HASH160:
+                case OP_HASH256:
+                {
+                    // (in -- hash)
+                    if (stack.size() < 1)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    const valtype& vch = stacktop(-1);
+                    valtype vchHash((opcode == OP_RIPEMD160 || opcode == OP_SHA1 || opcode == OP_HASH160) ? 20 : 32);
+                    // BIP#ops:
+                    // OP_RIPEMD160 and OP_SHA1 are now defined to FAIL if their operands exceed 520 bytes.
+                    if (opcode == OP_RIPEMD160 || opcode == OP_SHA1) {
+                        // Cannot happen outside Tapscript v2
+                        if (vch.size() > MAX_SCRIPT_ELEMENT_SIZE) {
+                            return set_error(serror, SCRIPT_ERR_PUSH_SIZE);
+                        }
+                    } else {
+                        // BIP#ops:
+                        // |OP_SHA256
+                        // |(Length of the operand) * 10
+                        // |-
+                        // |OP_HASH160
+                        // |(Length of the operand) * 10
+                        // |-
+                        // |OP_HASH256
+                        // |(Length of the operand) * 10
+                        varcost += vch.size() * VAROPS_COST_PER_BYTE_HASHED;
+                    }
+                    if (opcode == OP_RIPEMD160)
+                        CRIPEMD160().Write(vch.data(), vch.size()).Finalize(vchHash.data());
+                    else if (opcode == OP_SHA1)
+                        CSHA1().Write(vch.data(), vch.size()).Finalize(vchHash.data());
+                    else if (opcode == OP_SHA256)
+                        CSHA256().Write(vch.data(), vch.size()).Finalize(vchHash.data());
+                    else if (opcode == OP_HASH160)
+                        CHash160().Write(vch).Finalize(vchHash);
+                    else if (opcode == OP_HASH256)
+                        CHash256().Write(vch).Finalize(vchHash);
+                    popstack(stack);
+                    stack.push_back(vchHash);
+                }
+                break;
+
+                case OP_CODESEPARATOR:
+                {
+                    // If SCRIPT_VERIFY_CONST_SCRIPTCODE flag is set, use of OP_CODESEPARATOR is rejected in pre-segwit
+                    // script, even in an unexecuted branch (this is checked above the opcode case statement).
+
+                    // Hash starts after the code separator
+                    pbegincodehash = pc;
+                    execdata.m_codeseparator_pos = opcode_pos;
+                }
+                break;
+
+                case OP_CHECKSIG:
+                case OP_CHECKSIGVERIFY:
+                {
+                    // (sig pubkey -- bool)
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    const valtype& vchSig    = stacktop(-2);
+                    const valtype& vchPubKey = stacktop(-1);
+
+                    bool fSuccess = true;
+                    if (!EvalChecksig(vchSig, vchPubKey, pbegincodehash, pend, execdata, flags, checker, sigversion, serror, fSuccess)) return false;
+
+                    if (fSuccess) {
+                        varcost += VAROPS_COST_PER_SIGOP;
+                    }
+
+                    popstack(stack);
+                    popstack(stack);
+                    stack.push_back(fSuccess ? vchTrue : vchFalse);
+                    if (opcode == OP_CHECKSIGVERIFY)
+                    {
+                        if (fSuccess)
+                            popstack(stack);
+                        else
+                            return set_error(serror, SCRIPT_ERR_CHECKSIGVERIFY);
+                    }
+                }
+                break;
+
+                case OP_CHECKSIGADD:
+                {
+                    // (sig num pubkey -- num)
+                    if (stack.size() < 3) return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    const valtype& sig = stacktop(-3);
+                    const valtype& pubkey = stacktop(-1);
+
+                    bool success = true;
+                    if (!EvalChecksig(sig, pubkey, pbegincodehash, pend, execdata, flags, checker, sigversion, serror, success)) return false;
+
+                    if (success) {
+                        varcost += VAROPS_COST_PER_SIGOP;
+                    }
+
+                    valtype numvec;
+                    Val64 num;
+                    if (!stack.pop64(num, stack.size() - 2)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+
+                    if (success)
+                        Val64::op_1add(num, varcost);
+
+                    numvec = num.move_to_valtype();
+                    popstack(stack);
+                    popstack(stack);
+                    stack.push_back(numvec);
+                }
+                break;
+
+                case OP_CHECKMULTISIG:
+                case OP_CHECKMULTISIGVERIFY:
+                {
+                    return set_error(serror, SCRIPT_ERR_TAPSCRIPT_CHECKMULTISIG);
+                }
+                break;
+
+                // These are TAPSCRIPT_V2 only:
+                case OP_CAT:
+                {
+                    if (stack.size() < 2)
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+
+                    // BIP#ops:
+                    // |OP_CAT
+                    // |Sum of two operand lengths (COPYING)
+
+                    // Pop in reverse order (top first, then second-to-top)
+                    valtype vch2 = stack.pop_back_valtype();
+                    valtype vch1 = stack.pop_back_valtype();
+                    varcost += vch1.size() + vch2.size();
+
+                    vch1.insert(vch1.end(), vch2.begin(), vch2.end());
+                    stack.push_back(std::move(vch1));
+                }
+                break;
+
+                case OP_SUBSTR:
+                {
+                    // A BEGIN LEN -- A[BEGIN:BEGIN+LEN]
+                    Val64 begin_v64, len_v64;
+                    if (!stack.pop64(len_v64) ||
+                        !stack.pop64(begin_v64) ||
+                        stack.size() < 1) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    valtype vch = stack.pop_back_valtype();
+
+                    // BIP#ops:
+                    // |OP_SUBSTR
+                    // |(Sum of lengths of LEN and BEGIN operands)
+                    //  + MIN(Value of first operand (LEN), Length of operand A - Value of BEGIN, 0)
+                    //  (LENGTHCONV + COPYING)
+                    uint64_t begin = begin_v64.to_u64_ceil(vch.size(), varcost);
+                    uint64_t len = len_v64.to_u64_ceil(vch.size() - begin, varcost);
+
+                    // len is already capped to MIN(LEN, LEN(a) - BEGIN, 0)
+                    varcost += len;
+
+                    valtype vch2(vch.begin() + begin, vch.begin() + begin + len);
+                    stack.push_back(std::move(vch2));
+                }
+                break;
+
+                case OP_LEFT:
+                {
+                    // A OFFSET -- A[:OFFSET]
+                    Val64 offset_v64;
+                    if (!stack.pop64(offset_v64) ||
+                        stack.size() < 1) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+
+                    // BIP#ops:
+                    // |OP_LEFT
+                    // |Length of OFFSET operand
+                    uint64_t offset = offset_v64.to_u64_ceil(stack.back().size(), varcost);
+                    valtype vch = stack.pop_back_valtype();  // Move instead of copy
+                    vch.erase(vch.begin() + offset, vch.end());
+                    stack.push_back(std::move(vch));
+                }
+                break;
+
+                case OP_RIGHT:
+                {
+                    // A OFFSET -- A[-OFFSET:]
+                    Val64 offset_v64;
+                    if (!stack.pop64(offset_v64) ||
+                        stack.size() < 1) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+
+                    // BIP#ops:
+                    // |OP_RIGHT
+                    // |Length of OFFSET operand + MIN(Length of A, Value of OFFSET) (LENGTHCONV + COPYING)
+                    uint64_t offset = offset_v64.to_u64_ceil(stack.back().size(), varcost);
+                    valtype vch = stack.pop_back_valtype();  // Move instead of copy
+
+                    if (offset >= vch.size()) {
+                        varcost += vch.size();
+                    } else {
+                        vch.erase(vch.begin(), vch.end() - offset);
+                        varcost += offset;
+                    }
+                    stack.push_back(std::move(vch));
+                }
+                break;
+
+                // Taproot v2 unary ops.
+                case OP_INVERT:
+                case OP_2MUL:
+                case OP_2DIV:
+                {
+                    Val64 v64;
+                    if (!stack.pop64(v64)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+                    // Puts result back in v64a
+                    switch (opcode)
+                    {
+                    case OP_INVERT: Val64::op_invert(v64, varcost); break;
+                    case OP_2MUL:   Val64::op_2mul(v64, varcost); break;
+                    case OP_2DIV:   Val64::op_2div(v64, varcost); break;
+                    default:        assert(!"invalid opcode");
+                    }
+                    pushVal64(stack, v64);
+                }
+                break;
+
+                // Taproot v2 binary ops.
+                case OP_AND:
+                case OP_OR:
+                case OP_XOR:
+                case OP_MUL:
+                case OP_DIV:
+                case OP_MOD:
+                case OP_LSHIFT:
+                case OP_RSHIFT:
+                {
+                    Val64 v64a, v64b;
+                    if (!stack.pop64(v64b) ||
+                        !stack.pop64(v64a)) {
+                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
+                    }
+
+                    // Puts result back in v64a
+                    switch (opcode)
+                    {
+                    case OP_AND:
+                        Val64::op_and(v64a, v64b, varcost);
+                        break;
+
+                    case OP_OR:
+                        Val64::op_or(v64a, v64b, varcost);
+                        break;
+
+                    case OP_XOR:
+                        Val64::op_xor(v64a, v64b, varcost);
+                        break;
+
+                    case OP_MUL:
+                        // BIP#ops:
+                        // |OP_MUL
+                        // ...
+                        // # Calculate the varops cost of the operation: if it
+                        // exceeds the remaining budget, fail.
+                        varcost = Val64::op_mul_varcost(v64a, v64b);
+                        if (varcost > varops_budget)
+                            return set_error(serror, SCRIPT_ERR_VAROP_COUNT);
+                        v64a = Val64::op_mul(v64a, v64b);
+                        break;
+
+                    case OP_DIV:
+                        // BIP#ops:
+                        // |OP_DIV
+                        // ...
+                        // # Calculate the varops cost of the operation: if it
+                        // exceeds the remaining budget, fail.
+                        varcost = Val64::op_div_varcost(v64a, v64b);
+                        if (varcost > varops_budget)
+                            return set_error(serror, SCRIPT_ERR_VAROP_COUNT);
+                        if (!Val64::op_div(v64a, v64b))
+                            return set_error(serror, SCRIPT_ERR_DIVIDE_BY_ZERO);
+                        break;
+
+                    case OP_MOD:
+                        // BIP#ops:
+                        // |OP_MOD
+                        // ...
+                        // # Calculate the varops cost of the operation: if it
+                        // exceeds the remaining budget, fail.
+                        varcost = Val64::op_mod_varcost(v64a, v64b);
+                        if (varcost > varops_budget)
+                            return set_error(serror, SCRIPT_ERR_VAROP_COUNT);
+                        if (!Val64::op_mod(v64a, v64b))
+                            return set_error(serror, SCRIPT_ERR_DIVIDE_BY_ZERO);
+                        break;
+
+                    case OP_LSHIFT:
+                        if (!Val64::op_upshift(v64a, v64b,
+                                                MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE,
+                                                varcost)) {
+                            return set_error(serror, SCRIPT_ERR_STACK_SIZE);
+                        }
+                        break;
+
+                    case OP_RSHIFT:
+                        Val64::op_downshift(v64a, v64b, varcost);
+                        break;
+
+                    default:
+                        assert(!"invalid opcode");
+                    }
+
+                    pushVal64(stack, v64a);
+                }
+                break;
+
+                default:
+                    return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+            }
+
+            // Size limits
+            if (stack.size() + altstack.size() > MAX_TAPSCRIPT_V2_STACK_SIZE) {
+                return set_error(serror, SCRIPT_ERR_STACK_SIZE);
+            }
+
+            // This is impossible to violate prior to tapscript v2.
+            size_t largest_element_size = 0;
+            if (stack.total_stack_size(largest_element_size) + altstack.total_stack_size(largest_element_size) > MAX_TAPSCRIPT_V2_TOTAL_STACK_SIZE) {
+                return set_error(serror, SCRIPT_ERR_TOTAL_STACK_SIZE);
+            }
+
+            // Note: with all ops so far, violator would have to be top of stack
+            if (largest_element_size > MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE) {
+                return set_error(serror, SCRIPT_ERR_STACK_ELEMENT_SIZE);
+
+            }
+
+            // Budget limits
+            if (varcost > varops_budget) {
+                return set_error(serror, SCRIPT_ERR_VAROP_COUNT);
+            }
+            varops_budget -= varcost;
+
+        }
+    }
+    catch (...)
+    {
+        return set_error(serror, SCRIPT_ERR_UNKNOWN_ERROR);
+    }
+
+    if (!vfExec.empty())
+        return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
+
+    return set_success(serror);
+}
+
+bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* serror)
+{
+    ScriptExecutionData execdata;
+    return EvalScript(stack, script, flags, checker, sigversion, execdata, serror);
+}
+
+namespace {
+
+/**
+ * Wrapper that serializes like CTransaction, but with the modifications
+ *  required for the signature hash done in-place
+ */
+template <class T>
+class CTransactionSignatureSerializer
+{
+private:
+    const T& txTo;             //!< reference to the spending transaction (the one being serialized)
+    const CScript& scriptCode; //!< output script being consumed
+    const unsigned int nIn;    //!< input index of txTo being signed
+    const bool fAnyoneCanPay;  //!< whether the hashtype has the SIGHASH_ANYONECANPAY flag set
+    const bool fHashSingle;    //!< whether the hashtype is SIGHASH_SINGLE
+    const bool fHashNone;      //!< whether the hashtype is SIGHASH_NONE
+
+public:
+    CTransactionSignatureSerializer(const T& txToIn, const CScript& scriptCodeIn, unsigned int nInIn, int nHashTypeIn) :
+        txTo(txToIn), scriptCode(scriptCodeIn), nIn(nInIn),
+        fAnyoneCanPay(!!(nHashTypeIn & SIGHASH_ANYONECANPAY)),
+        fHashSingle((nHashTypeIn & 0x1f) == SIGHASH_SINGLE),
+        fHashNone((nHashTypeIn & 0x1f) == SIGHASH_NONE) {}
+
+    /** Serialize the passed scriptCode, skipping OP_CODESEPARATORs */
+    template<typename S>
+    void SerializeScriptCode(S &s) const {
+        CScript::const_iterator it = scriptCode.begin();
+        CScript::const_iterator itBegin = it;
+        opcodetype opcode;
+        unsigned int nCodeSeparators = 0;
+        while (scriptCode.GetOp(it, opcode)) {
+            if (opcode == OP_CODESEPARATOR)
+                nCodeSeparators++;
+        }
+        ::WriteCompactSize(s, scriptCode.size() - nCodeSeparators);
+        it = itBegin;
+        while (scriptCode.GetOp(it, opcode)) {
+            if (opcode == OP_CODESEPARATOR) {
+                s.write(AsBytes(Span{&itBegin[0], size_t(it - itBegin - 1)}));
+                itBegin = it;
+            }
+        }
+        if (itBegin != scriptCode.end())
+            s.write(AsBytes(Span{&itBegin[0], size_t(it - itBegin)}));
+    }
+
+    /** Serialize an input of txTo */
+    template<typename S>
+    void SerializeInput(S &s, unsigned int nInput) const {
+        // In case of SIGHASH_ANYONECANPAY, only the input being signed is serialized
+        if (fAnyoneCanPay)
+            nInput = nIn;
+        // Serialize the prevout
+        ::Serialize(s, txTo.vin[nInput].prevout);
+        // Serialize the script
+        if (nInput != nIn)
+            // Blank out other inputs' signatures
+            ::Serialize(s, CScript());
+        else
+            SerializeScriptCode(s);
+        // Serialize the nSequence
+        if (nInput != nIn && (fHashSingle || fHashNone))
+            // let the others update at will
+            ::Serialize(s, int32_t{0});
+        else
+            ::Serialize(s, txTo.vin[nInput].nSequence);
+    }
+
+    /** Serialize an output of txTo */
+    template<typename S>
+    void SerializeOutput(S &s, unsigned int nOutput) const {
+        if (fHashSingle && nOutput != nIn)
+            // Do not lock-in the txout payee at other indices as txin
+            ::Serialize(s, CTxOut());
+        else
+            ::Serialize(s, txTo.vout[nOutput]);
+    }
+
+    /** Serialize txTo */
+    template<typename S>
+    void Serialize(S &s) const {
+        // Serialize version
+        ::Serialize(s, txTo.version);
+        // Serialize vin
+        unsigned int nInputs = fAnyoneCanPay ? 1 : txTo.vin.size();
+        ::WriteCompactSize(s, nInputs);
+        for (unsigned int nInput = 0; nInput < nInputs; nInput++)
+             SerializeInput(s, nInput);
+        // Serialize vout
+        unsigned int nOutputs = fHashNone ? 0 : (fHashSingle ? nIn+1 : txTo.vout.size());
+        ::WriteCompactSize(s, nOutputs);
+        for (unsigned int nOutput = 0; nOutput < nOutputs; nOutput++)
+             SerializeOutput(s, nOutput);
+        // Serialize nLockTime
+        ::Serialize(s, txTo.nLockTime);
+    }
+};
+
+/** Compute the (single) SHA256 of the concatenation of all prevouts of a tx. */
+template <class T>
+uint256 GetPrevoutsSHA256(const T& txTo)
+{
+    HashWriter ss{};
+    for (const auto& txin : txTo.vin) {
+        ss << txin.prevout;
+    }
+    return ss.GetSHA256();
+}
+
+/** Compute the (single) SHA256 of the concatenation of all nSequences of a tx. */
+template <class T>
+uint256 GetSequencesSHA256(const T& txTo)
+{
+    HashWriter ss{};
+    for (const auto& txin : txTo.vin) {
+        ss << txin.nSequence;
+    }
+    return ss.GetSHA256();
+}
+
+/** Compute the (single) SHA256 of the concatenation of all txouts of a tx. */
+template <class T>
+uint256 GetOutputsSHA256(const T& txTo)
+{
+    HashWriter ss{};
+    for (const auto& txout : txTo.vout) {
+        ss << txout;
+    }
+    return ss.GetSHA256();
+}
+
+/** Compute the (single) SHA256 of the concatenation of all amounts spent by a tx. */
+uint256 GetSpentAmountsSHA256(const std::vector<CTxOut>& outputs_spent)
+{
+    HashWriter ss{};
+    for (const auto& txout : outputs_spent) {
+        ss << txout.nValue;
+
+    }
+    return ss.GetSHA256();
+}
+
+/** Compute the (single) SHA256 of the concatenation of all scriptSigs in a tx. */
+template <class T>
+uint256 GetScriptSigsSHA256(const T& txTo)
+{
+    HashWriter ss{};
+    for (const auto& in : txTo.vin) {
+        ss << in.scriptSig;
+    }
+    return ss.GetSHA256();
+}
+
+/** Compute the (single) SHA256 of the concatenation of all scriptPubKeys spent by a tx. */
+uint256 GetSpentScriptsSHA256(const std::vector<CTxOut>& outputs_spent)
+{
+    HashWriter ss{};
+    for (const auto& txout : outputs_spent) {
+        ss << txout.scriptPubKey;
+    }
+    return ss.GetSHA256();
+}
 
 /* Not Exported, just convenience */
 template<typename TxType>
@@ -1725,6 +2776,7 @@ bool SignatureHashSchnorr(uint256& hash_out, ScriptExecutionData& execdata, cons
         // keyversion is not used.
         break;
     case SigVersion::TAPSCRIPT:
+    case SigVersion::TAPSCRIPT_V2:
         ext_flag = 1;
         break;
     default:
@@ -1809,7 +2861,7 @@ bool SignatureHashSchnorr(uint256& hash_out, ScriptExecutionData& execdata, cons
     }
 
     // Additional data for BIP 342 signatures
-    if (sigversion == SigVersion::TAPSCRIPT) {
+    if (sigversion == SigVersion::TAPSCRIPT || sigversion == SigVersion::TAPSCRIPT_V2) {
         assert(execdata.m_tapleaf_hash_init);
         if (input_type != SIGHASH_ANYPREVOUTANYSCRIPT) {
             ss << execdata.m_tapleaf_hash;
@@ -1933,7 +2985,7 @@ bool GenericTransactionSignatureChecker<T>::CheckECDSASignature(const std::vecto
 template <class T>
 bool GenericTransactionSignatureChecker<T>::CheckSchnorrSignature(Span<const unsigned char> sig, KeyVersion pubkeyver, Span<const unsigned char> pubkey, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* serror) const
 {
-    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
+    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT || sigversion == SigVersion::TAPSCRIPT_V2);
     // Schnorr signatures have 32-byte public keys. The caller is responsible for enforcing this.
     assert(pubkey.size() == 32);
 
@@ -2063,14 +3115,20 @@ bool GenericTransactionSignatureChecker<T>::CheckDefaultCheckTemplateVerifyHash(
 template class GenericTransactionSignatureChecker<CTransaction>;
 template class GenericTransactionSignatureChecker<CMutableTransaction>;
 
-[[maybe_unused]] static std::optional<bool> op_success_check(script_verify_flags flags, script_verify_flags enforce, script_verify_flags discourage, ScriptError discourage_err, ScriptError* serror)
+[[maybe_unused]] static std::optional<bool> op_success_check(script_verify_flags flags, script_verify_flags enforce, script_verify_flags discourage, ScriptError discourage_err, ScriptError* serror, std::optional<uint64_t> varops_budget)
 {
     if (flags & discourage) return set_error(serror, discourage_err);
     if (!(flags & enforce)) return set_success(serror);
     return std::nullopt;
 }
 
-std::optional<bool> CheckTapscriptOpSuccess(const CScript& exec_script, script_verify_flags flags, ScriptError* serror)
+// Overload for when varops_budget is not available in the calling context
+[[maybe_unused]] static std::optional<bool> op_success_check(script_verify_flags flags, script_verify_flags enforce, script_verify_flags discourage, ScriptError discourage_err, ScriptError* serror)
+{
+    return op_success_check(flags, enforce, discourage, discourage_err, serror, std::nullopt);
+}
+
+std::optional<bool> CheckTapscriptOpSuccess(const CScript& exec_script, script_verify_flags flags, SigVersion sigversion, ScriptError* serror, std::optional<uint64_t> varops_budget)
 {
     {
         // OP_SUCCESSx processing overrides everything, including stack element size limits
@@ -2082,7 +3140,7 @@ std::optional<bool> CheckTapscriptOpSuccess(const CScript& exec_script, script_v
                 return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
             }
             // New opcodes will be listed here. May use a different sigversion to modify existing opcodes.
-            if (IsOpSuccess(opcode)) {
+            if (IsOpSuccess(opcode, sigversion)) {
                 switch(opcode) {
                 INQ_SUCCESS_OPCODES
                 case OP_RESERVED:
@@ -2102,30 +3160,57 @@ std::optional<bool> CheckTapscriptOpSuccess(const CScript& exec_script, script_v
     return std::nullopt;
 }
 
-static bool ExecuteWitnessScript(const Span<const valtype>& stack_span, const CScript& exec_script, script_verify_flags flags, SigVersion sigversion, const BaseSignatureChecker& checker, ScriptExecutionData& execdata, ScriptError* serror)
+static bool ExecuteWitnessScript(const Span<const valtype>& stack_span, const CScript& exec_script, script_verify_flags flags, SigVersion sigversion, const BaseSignatureChecker& checker, ScriptExecutionData& execdata, ScriptError* serror, std::optional<uint64_t> varops_budget)
 {
     std::vector<valtype> stack{stack_span.begin(), stack_span.end()};
 
-    if (sigversion == SigVersion::TAPSCRIPT) {
+    if (sigversion == SigVersion::TAPSCRIPT || sigversion == SigVersion::TAPSCRIPT_V2) {
 
-        auto r = CheckTapscriptOpSuccess(exec_script, flags, serror);
+        auto r = CheckTapscriptOpSuccess(exec_script, flags, sigversion, serror, varops_budget);
         if (r.has_value()) return *r;
 
         // Tapscript enforces initial stack size limits (altstack is empty here)
-        if (stack.size() > MAX_STACK_SIZE) return set_error(serror, SCRIPT_ERR_STACK_SIZE);
+        if (sigversion != SigVersion::TAPSCRIPT_V2) {
+            if (stack.size() > MAX_STACK_SIZE) return set_error(serror, SCRIPT_ERR_STACK_SIZE);
+        } else {
+            // Tapscript v2 also enforces initial stack size limits (with its own limit)
+            if (stack.size() > MAX_TAPSCRIPT_V2_STACK_SIZE) return set_error(serror, SCRIPT_ERR_STACK_SIZE);
+        }
     }
 
-    // Disallow stack item size > MAX_SCRIPT_ELEMENT_SIZE in witness stack
-    for (const valtype& elem : stack) {
-        if (elem.size() > MAX_SCRIPT_ELEMENT_SIZE) return set_error(serror, SCRIPT_ERR_PUSH_SIZE);
+    if (sigversion != SigVersion::TAPSCRIPT_V2) {
+        // Disallow stack item size > MAX_SCRIPT_ELEMENT_SIZE in witness stack
+        for (const valtype& elem : stack) {
+            if (elem.size() > MAX_SCRIPT_ELEMENT_SIZE) return set_error(serror, SCRIPT_ERR_PUSH_SIZE);
+        }
     }
 
+    bool result;
     // Run the script interpreter.
-    if (!EvalScript(stack, exec_script, flags, checker, sigversion, execdata, serror)) return false;
+    if (sigversion == SigVersion::TAPSCRIPT_V2) {
+        if (!varops_budget) return set_error(serror, SCRIPT_ERR_VAROP_NULL);
+        ValtypeStack valtype_stack{stack};
+        if (!EvalGsrScript(valtype_stack, exec_script, flags, checker, sigversion, execdata, *varops_budget, serror)) return false;
+
+        // Scripts inside witness implicitly require cleanstack behaviour
+        if (valtype_stack.size() != 1) return set_error(serror, SCRIPT_ERR_CLEANSTACK);
+
+        // Check result
+        size_t varcost = 0;
+        valtype back_val = valtype_stack.back();
+        result = Val64(back_val).to_u64_ceil(1, varcost);
+    } else {
+        if (!EvalScript(stack, exec_script, flags, checker, sigversion, execdata, serror)) return false;
 
-    // Scripts inside witness implicitly require cleanstack behaviour
-    if (stack.size() != 1) return set_error(serror, SCRIPT_ERR_CLEANSTACK);
-    if (!CastToBool(stack.back())) return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
+        // Scripts inside witness implicitly require cleanstack behaviour
+        if (stack.size() != 1) return set_error(serror, SCRIPT_ERR_CLEANSTACK);
+
+        // Check result
+        result = CastToBool(stack.back());
+    }
+    if (!result) {
+        return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
+    }
     return true;
 }
 
@@ -2175,7 +3260,7 @@ static bool VerifyTaprootCommitment(const std::vector<unsigned char>& control, c
     return q.CheckTapTweak(p, merkle_root, control[0] & 1);
 }
 
-static bool VerifyWitnessProgram(const CScriptWitness& witness, int witversion, const std::vector<unsigned char>& program, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptError* serror, bool is_p2sh)
+static bool VerifyWitnessProgram(const CScriptWitness& witness, int witversion, const std::vector<unsigned char>& program, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptError* serror, bool is_p2sh, std::optional<uint64_t> varops_budget)
 {
     CScript exec_script; //!< Actually executed script (last stack item in P2WSH; implied P2PKH script in P2WPKH; leaf script in P2TR)
     Span stack{witness.stack};
@@ -2194,14 +3279,14 @@ static bool VerifyWitnessProgram(const CScriptWitness& witness, int witversion,
             if (memcmp(hash_exec_script.begin(), program.data(), 32)) {
                 return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH);
             }
-            return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::WITNESS_V0, checker, execdata, serror);
+            return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::WITNESS_V0, checker, execdata, serror, varops_budget);
         } else if (program.size() == WITNESS_V0_KEYHASH_SIZE) {
             // BIP141 P2WPKH: 20-byte witness v0 program (which encodes Hash160(pubkey))
             if (stack.size() != 2) {
                 return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH); // 2 items in witness
             }
             exec_script << OP_DUP << OP_HASH160 << program << OP_EQUALVERIFY << OP_CHECKSIG;
-            return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::WITNESS_V0, checker, execdata, serror);
+            return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::WITNESS_V0, checker, execdata, serror, varops_budget);
         } else {
             return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_WRONG_LENGTH);
         }
@@ -2241,7 +3326,14 @@ static bool VerifyWitnessProgram(const CScriptWitness& witness, int witversion,
                 exec_script = CScript(script.begin(), script.end());
                 execdata.m_validation_weight_left = ::GetSerializeSize(witness.stack) + VALIDATION_WEIGHT_OFFSET;
                 execdata.m_validation_weight_left_init = true;
-                return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::TAPSCRIPT, checker, execdata, serror);
+                return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::TAPSCRIPT, checker, execdata, serror, varops_budget);
+            }
+            if ((control[0] & TAPROOT_LEAF_MASK) == TAPROOT_LEAF_TAPSCRIPT_V2) {
+                // Tapscript v2 (leaf version 0xc2)
+                exec_script = CScript(script.begin(), script.end());
+                execdata.m_validation_weight_left = ::GetSerializeSize(witness.stack) + VALIDATION_WEIGHT_OFFSET;
+                execdata.m_validation_weight_left_init = true;
+                return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::TAPSCRIPT_V2, checker, execdata, serror, varops_budget);
             }
             if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION) {
                 return set_error(serror, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION);
@@ -2260,7 +3352,7 @@ static bool VerifyWitnessProgram(const CScriptWitness& witness, int witversion,
     // There is intentionally no return statement here, to be able to use "control reaches end of non-void function" warnings to detect gaps in the logic above.
 }
 
-bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptError* serror)
+bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptError* serror, std::optional<uint64_t> varops_budget /* = std::nullopt */)
 {
     static const CScriptWitness emptyWitness;
     if (witness == nullptr) {
@@ -2300,7 +3392,7 @@ bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const C
                 // The scriptSig must be _exactly_ CScript(), otherwise we reintroduce malleability.
                 return set_error(serror, SCRIPT_ERR_WITNESS_MALLEATED);
             }
-            if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/false)) {
+            if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/false, varops_budget)) {
                 return false;
             }
             // Bypass the cleanstack check at the end. The actual stack is obviously not clean
@@ -2345,7 +3437,7 @@ bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const C
                     // reintroduce malleability.
                     return set_error(serror, SCRIPT_ERR_WITNESS_MALLEATED_P2SH);
                 }
-                if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/true)) {
+                if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/true, varops_budget)) {
                     return false;
                 }
                 // Bypass the cleanstack check at the end. The actual stack is obviously not clean
diff --git a/src/script/interpreter.h b/src/script/interpreter.h
index a7abf4cab6ac..d37dfdbb05e0 100644
--- a/src/script/interpreter.h
+++ b/src/script/interpreter.h
@@ -24,6 +24,8 @@
 
 class CScript;
 class CScriptNum;
+class XOnlyPubKey;
+class ValtypeStack;
 struct CScriptWitness;
 
 /** Signature hash types/flags */
@@ -222,14 +224,6 @@ template<typename TxType>
 uint256 GetDefaultCheckTemplateVerifyHash(const TxType& tx, const uint256& outputs_hash, const uint256& sequences_hash,
                                 const uint32_t input_index);
 
-enum class SigVersion
-{
-    BASE = 0,        //!< Bare scripts and BIP16 P2SH-wrapped redeemscripts
-    WITNESS_V0 = 1,  //!< Witness v0 (P2WPKH and P2WSH); see BIP 141
-    TAPROOT = 2,     //!< Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, key path spending; see BIP 341
-    TAPSCRIPT = 3,   //!< Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, script path spending, leaf version 0xc0; see BIP 342
-};
-
 enum class KeyVersion
 {
     TAPROOT = 0,     //!< 32 byte public key
@@ -274,6 +268,7 @@ static constexpr size_t WITNESS_V1_TAPROOT_SIZE = 32;
 
 static constexpr uint8_t TAPROOT_LEAF_MASK = 0xfe;
 static constexpr uint8_t TAPROOT_LEAF_TAPSCRIPT = 0xc0;
+static constexpr uint8_t TAPROOT_LEAF_TAPSCRIPT_V2 = 0xc2;
 static constexpr size_t TAPROOT_CONTROL_BASE_SIZE = 33;
 static constexpr size_t TAPROOT_CONTROL_NODE_SIZE = 32;
 static constexpr size_t TAPROOT_CONTROL_MAX_NODE_COUNT = 128;
@@ -397,13 +392,14 @@ uint256 ComputeTaprootMerkleRoot(Span<const unsigned char> control, const uint25
 
 bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* error = nullptr);
 bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* error = nullptr);
-bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptError* serror = nullptr);
+bool EvalGsrScript(ValtypeStack& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptExecutionData& execdata, uint64_t& varops_budget, ScriptError* error = nullptr);
+bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptError* serror = nullptr, std::optional<uint64_t> varops_budget = std::nullopt);
 
 size_t CountWitnessSigOps(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, script_verify_flags flags);
 
 int FindAndDelete(CScript& script, const CScript& b);
 
 bool CastToBool(const std::vector<unsigned char>& vch);
-std::optional<bool> CheckTapscriptOpSuccess(const CScript& exec_script, script_verify_flags flags, ScriptError* serror);
+std::optional<bool> CheckTapscriptOpSuccess(const CScript& exec_script, script_verify_flags flags, SigVersion sigversion, ScriptError* serror, std::optional<uint64_t> varops_budget);
 
 #endif // BITCOIN_SCRIPT_INTERPRETER_H
diff --git a/src/script/script.cpp b/src/script/script.cpp
index 1bb0d4a07812..73ca7c325f39 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -365,8 +365,12 @@ bool GetScriptOp(CScriptBase::const_iterator& pc, CScriptBase::const_iterator en
     return true;
 }
 
-bool IsOpSuccess(const opcodetype& opcode)
+bool IsOpSuccess(const opcodetype& opcode, SigVersion sigversion /* = SigVersion::BASE */)
 {
+    if (sigversion == SigVersion::TAPSCRIPT_V2) {
+        return opcode == 80 || opcode == 98 || (opcode >= 137 && opcode <= 138) ||
+            (opcode >= 187 && opcode <= 254);
+    }
     return opcode == 80 || opcode == 98 || (opcode >= 126 && opcode <= 129) ||
            (opcode >= 131 && opcode <= 134) || (opcode >= 137 && opcode <= 138) ||
            (opcode >= 141 && opcode <= 142) || (opcode >= 149 && opcode <= 153) ||
diff --git a/src/script/script.h b/src/script/script.h
index 391fe23ddabb..01c284132151 100644
--- a/src/script/script.h
+++ b/src/script/script.h
@@ -25,33 +25,49 @@
 #include <utility>
 #include <vector>
 
-// Maximum number of bytes pushable to the stack
-static const unsigned int MAX_SCRIPT_ELEMENT_SIZE = 520;
+// Maximum number of bytes pushable to the stack (up to Tapscript v2)
+static constexpr unsigned int MAX_SCRIPT_ELEMENT_SIZE = 520;
 
 // Maximum number of non-push operations per script
-static const int MAX_OPS_PER_SCRIPT = 201;
+static constexpr int MAX_OPS_PER_SCRIPT = 201;
 
 // Maximum number of public keys per multisig
-static const int MAX_PUBKEYS_PER_MULTISIG = 20;
+static constexpr int MAX_PUBKEYS_PER_MULTISIG = 20;
 
 /** The limit of keys in OP_CHECKSIGADD-based scripts. It is due to the stack limit in BIP342. */
 static constexpr unsigned int MAX_PUBKEYS_PER_MULTI_A = 999;
 
-// Maximum script length in bytes
-static const int MAX_SCRIPT_SIZE = 10000;
+// Maximum script length in bytes (pre-Taproot)
+static constexpr int MAX_SCRIPT_SIZE = 10000;
 
 // Maximum number of values on script interpreter stack
-static const int MAX_STACK_SIZE = 1000;
+static constexpr int MAX_STACK_SIZE = 1000;
+
+// Maximum number of values on script interpreter stack (Tapscript v2)
+static constexpr int MAX_TAPSCRIPT_V2_STACK_SIZE = 32000;
+
+// BIP#ops: The individual stack entry limit of 520 bytes is increased to the
+// total block weight (4000000) bytes.  An additional gross limit of twice
+// that (8000000) applies across all stack entries.
+static constexpr int MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE = 4000000;
+static constexpr int MAX_TAPSCRIPT_V2_TOTAL_STACK_SIZE = 2 * MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE;
+
+// Varops cost per byte hashed in Tapscript v2
+static constexpr int VAROPS_COST_PER_BYTE_HASHED = 10;
+
+// BIP#ops: A per-transaction "varops budget" is determined by multiplying the
+// total transaction weight by the fixed factor 5200.
+static constexpr int VAROPS_BUDGET_PER_BYTE = 5200;
 
 // Threshold for nLockTime: below this value it is interpreted as block number,
 // otherwise as UNIX timestamp.
-static const unsigned int LOCKTIME_THRESHOLD = 500000000; // Tue Nov  5 00:53:20 1985 UTC
+static constexpr unsigned int LOCKTIME_THRESHOLD = 500000000; // Tue Nov  5 00:53:20 1985 UTC
 
 // Maximum nLockTime. Since a lock time indicates the last invalid timestamp, a
 // transaction with this lock time will never be valid unless lock time
 // checking is disabled (by setting all input sequence numbers to
 // SEQUENCE_FINAL).
-static const uint32_t LOCKTIME_MAX = 0xFFFFFFFFU;
+static constexpr uint32_t LOCKTIME_MAX = 0xFFFFFFFFU;
 
 // Tag for input annex. If there are at least two witness elements for a transaction input,
 // and the first byte of the last element is 0x50, this last element is called annex, and
@@ -64,6 +80,10 @@ static constexpr int64_t VALIDATION_WEIGHT_PER_SIGOP_PASSED{50};
 // How much weight budget is added to the witness size (Tapscript only, see BIP 342).
 static constexpr int64_t VALIDATION_WEIGHT_OFFSET{50};
 
+// BIP#ops: Signature operations cost 260,000 varops units (5,200 * 50)
+static constexpr int VAROPS_COST_PER_SIGOP = VAROPS_BUDGET_PER_BYTE * VALIDATION_WEIGHT_PER_SIGOP_PASSED;
+
+
 template <typename T>
 std::vector<unsigned char> ToByteVector(const T& in)
 {
@@ -220,6 +240,14 @@ static const unsigned int MAX_OPCODE = OP_NOP10;
 
 std::string GetOpName(opcodetype opcode);
 
+enum class SigVersion
+{
+    BASE = 0,        //!< Bare scripts and BIP16 P2SH-wrapped redeemscripts
+    WITNESS_V0 = 1,  //!< Witness v0 (P2WPKH and P2WSH); see BIP 141
+    TAPROOT = 2,     //!< Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, key path spending; see BIP 341
+    TAPSCRIPT = 3,   //!< Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, script path spending, leaf version 0xc0; see BIP 342
+    TAPSCRIPT_V2 = 4,   //!< Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, script path spending, leaf version 0xc2;
+};
 class scriptnum_error : public std::runtime_error
 {
 public:
@@ -611,7 +639,7 @@ class CScriptID : public BaseHash<uint160>
 };
 
 /** Test for OP_SUCCESSx opcodes as defined by BIP342. */
-bool IsOpSuccess(const opcodetype& opcode);
+bool IsOpSuccess(const opcodetype& opcode, SigVersion sigversion = SigVersion::BASE);
 
 bool CheckMinimalPush(const std::vector<unsigned char>& data, opcodetype opcode);
 
diff --git a/src/script/script_error.cpp b/src/script/script_error.cpp
index 8f49cd783c8a..d69f0e9035dd 100644
--- a/src/script/script_error.cpp
+++ b/src/script/script_error.cpp
@@ -37,6 +37,10 @@ std::string ScriptErrorString(const ScriptError serror)
             return "Operation limit exceeded";
         case SCRIPT_ERR_STACK_SIZE:
             return "Stack size limit exceeded";
+        case SCRIPT_ERR_TOTAL_STACK_SIZE:
+            return "Total stack size limit exceeded";
+        case SCRIPT_ERR_STACK_ELEMENT_SIZE:
+            return "Stack element size limit exceeded";
         case SCRIPT_ERR_SIG_COUNT:
             return "Signature count negative or greater than pubkey count";
         case SCRIPT_ERR_PUBKEY_COUNT:
@@ -119,12 +123,18 @@ std::string ScriptErrorString(const ScriptError serror)
             return "Using OP_CODESEPARATOR in non-witness script";
         case SCRIPT_ERR_SIG_FINDANDDELETE:
             return "Signature is found in scriptCode";
-
+        case SCRIPT_ERR_DIVIDE_BY_ZERO:
+            return "OP_DIV or OP_MOD by zero";
+        case SCRIPT_ERR_SUB_UNDERFLOW:
+            return "OP_SUB or OP_SUB1 result would be negative";
+        case SCRIPT_ERR_VAROP_COUNT:
+            return "Varops count exceeded";
+        case SCRIPT_ERR_VAROP_NULL:
+            return "Varops must not be null in tapscript v2";
         INQ_SCRIPTERR_STRING
-
         case SCRIPT_ERR_UNKNOWN_ERROR:
         case SCRIPT_ERR_ERROR_COUNT:
-        default: break;
+            break;
     }
     return "unknown error";
 }
diff --git a/src/script/script_error.h b/src/script/script_error.h
index fd10bf91451b..bf3b23131da7 100644
--- a/src/script/script_error.h
+++ b/src/script/script_error.h
@@ -22,6 +22,8 @@ typedef enum ScriptError_t
     SCRIPT_ERR_PUSH_SIZE,
     SCRIPT_ERR_OP_COUNT,
     SCRIPT_ERR_STACK_SIZE,
+    SCRIPT_ERR_TOTAL_STACK_SIZE,
+    SCRIPT_ERR_STACK_ELEMENT_SIZE,
     SCRIPT_ERR_SIG_COUNT,
     SCRIPT_ERR_PUBKEY_COUNT,
 
@@ -88,6 +90,12 @@ typedef enum ScriptError_t
     /* Inquisition additions */
     INQ_SCRIPTERR
 
+    /* Tapscript v2 */
+    SCRIPT_ERR_DIVIDE_BY_ZERO,
+    SCRIPT_ERR_SUB_UNDERFLOW,
+    SCRIPT_ERR_VAROP_COUNT,
+    SCRIPT_ERR_VAROP_NULL,
+
     SCRIPT_ERR_ERROR_COUNT
 } ScriptError;
 
diff --git a/src/script/sign.cpp b/src/script/sign.cpp
index 61f578769c13..4dd54d2dc6ff 100644
--- a/src/script/sign.cpp
+++ b/src/script/sign.cpp
@@ -61,7 +61,7 @@ bool MutableTransactionSignatureCreator::CreateSig(const SigningProvider& provid
 
 bool MutableTransactionSignatureCreator::CreateSchnorrSig(const SigningProvider& provider, std::vector<unsigned char>& sig, const XOnlyPubKey& pubkey, const uint256* leaf_hash, const uint256* merkle_root, SigVersion sigversion) const
 {
-    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
+    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT || sigversion == SigVersion::TAPSCRIPT_V2);
 
     CKey key;
     if (!provider.GetKeyByXOnly(pubkey, key)) return false;
@@ -74,7 +74,7 @@ bool MutableTransactionSignatureCreator::CreateSchnorrSig(const SigningProvider&
     ScriptExecutionData execdata;
     execdata.m_annex_init = true;
     execdata.m_annex_present = false; // Only support annex-less signing for now.
-    if (sigversion == SigVersion::TAPSCRIPT) {
+    if (sigversion == SigVersion::TAPSCRIPT || sigversion == SigVersion::TAPSCRIPT_V2) {
         execdata.m_codeseparator_pos_init = true;
         execdata.m_codeseparator_pos = 0xFFFFFFFF; // Only support non-OP_CODESEPARATOR BIP342 signing for now.
         if (!leaf_hash) return false; // BIP342 signing needs leaf hash.
@@ -320,7 +320,7 @@ struct TapSatisfier: Satisfier<XOnlyPubKey> {
 static bool SignTaprootScript(const SigningProvider& provider, const BaseSignatureCreator& creator, SignatureData& sigdata, int leaf_version, Span<const unsigned char> script_bytes, std::vector<valtype>& result)
 {
     // Only BIP342 tapscript signing is supported for now.
-    if (leaf_version != TAPROOT_LEAF_TAPSCRIPT) return false;
+    if (leaf_version != TAPROOT_LEAF_TAPSCRIPT && leaf_version != TAPROOT_LEAF_TAPSCRIPT_V2) return false;
 
     uint256 leaf_hash = ComputeTapleafHash(leaf_version, script_bytes);
     CScript script = CScript(script_bytes.begin(), script_bytes.end());
diff --git a/src/script/val64.cpp b/src/script/val64.cpp
new file mode 100644
index 000000000000..8dcf801d54f5
--- /dev/null
+++ b/src/script/val64.cpp
@@ -0,0 +1,1142 @@
+// Copyright (c) 2024 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/val64.h>
+#include <bit>
+#include <cassert>
+#include <cstring>
+#include <memory>
+#include <compat/endian.h>
+#include <iostream>
+
+// MSVC compatibility: __int128 and __builtin_add_overflow are not available
+#if !defined(__SIZEOF_INT128__) && defined(_MSC_VER)
+#define PORTABLE_64BIT_MATH 1
+#endif
+
+
+// For testing.
+bool Val64::force_unaligned = false;
+bool Val64::force_portable_math = false;
+bool Val64::suppress_alignment_warnings = false;
+
+void Val64::warn_alignment_once(const void *p, size_t len)
+{
+    static bool warned = false;
+
+    if (warned || suppress_alignment_warnings)
+        return;
+
+    std::cerr
+        << "WARNING: Vector pointer " << p
+        << " size " << len
+        << " is misaligned: performance may suffer"
+        << std::endl;
+    warned = true;
+}
+
+Val64::Val64(std::vector<unsigned char> &v)
+{
+    move_from_valtype(v);
+}
+
+size_t Val64::u64ptr_off() const
+{
+    const unsigned char *p = reinterpret_cast<const unsigned char *>(m_u64span.data());
+
+    /* Sanity check it's in bounds */
+    assert(p >= m_charvec.data());
+    assert(p + m_realsize <= m_charvec.data() + m_charvec.size());
+
+    return p - m_charvec.data();
+}
+
+// Only m_charvec is set: initialize other fields.
+void Val64::set_span()
+{
+    m_realsize = m_charvec.size();
+
+    // Round up to get number of u64s
+    size_t u64size = (m_realsize + sizeof(uint64_t) - 1) / sizeof(uint64_t);
+
+    // Enlarge if necessary (trailing zeroes are harmless in little-endian)
+    if (m_charvec.size() < u64size * sizeof(uint64_t))
+        m_charvec.insert(m_charvec.end(), u64size * sizeof(uint64_t) - m_charvec.size(), 0);
+
+    // We are always 64-bit aligned, but we handle it if we're not.
+    size_t space = m_charvec.size();
+    void *ptr = m_charvec.data();
+    if (std::align(alignof(uint64_t), u64size * sizeof(uint64_t), ptr, space) == m_charvec.data()
+        && ptr == m_charvec.data()
+        && !force_unaligned) {
+        m_u64span = std::span<le64_t>(reinterpret_cast<uint64_t *>(m_charvec.data()), u64size);
+        return;
+    }
+
+    Val64::warn_alignment_once(m_charvec.data(), m_charvec.size());
+
+    // Append zeroes so we can move values.  This might change alignment.
+    m_charvec.insert(m_charvec.end(), sizeof(uint64_t), 0);
+    space = m_charvec.size();
+    ptr = m_charvec.data();
+    std::align(alignof(uint64_t), u64size * sizeof(uint64_t), ptr, space);
+
+    // For testing, it will actually be aligned, so move a whole u64.
+    if (force_unaligned && ptr == m_charvec.data())
+        ptr = m_charvec.data() + sizeof(uint64_t);
+
+    m_u64span = std::span<le64_t>(reinterpret_cast<uint64_t *>(ptr), u64size);
+
+    // Figure out how much the offset now is, so we can move data.
+    size_t off = u64ptr_off();
+    memmove(m_charvec.data() + off, m_charvec.data(), u64size * sizeof(uint64_t));
+}
+
+// Remove offset because we're changing m_charvec.
+void Val64::charvec_change_start()
+{
+    size_t off = u64ptr_off();
+    if (off)
+        m_charvec.erase(m_charvec.begin(), m_charvec.begin() + off);
+
+    // Trim any added bytes.
+    assert(m_realsize <= m_charvec.size());
+    m_charvec.resize(m_realsize);
+}
+
+void Val64::charvec_change_end()
+{
+    set_span();
+}
+
+void Val64::remove_front(size_t bytes)
+{
+    assert(bytes <= m_realsize);
+
+    charvec_change_start();
+    m_charvec.erase(m_charvec.begin(), m_charvec.begin() + bytes);
+    charvec_change_end();
+}
+
+void Val64::prepend_zeros(size_t prebytes)
+{
+    charvec_change_start();
+    m_charvec.insert(m_charvec.begin(), prebytes, 0);
+    charvec_change_end();
+}
+
+void Val64::truncate(size_t new_realsize)
+{
+    assert(new_realsize <= m_charvec.size());
+
+    charvec_change_start();
+    m_charvec.resize(new_realsize);
+    charvec_change_end();
+}
+
+void Val64::move_from_valtype(std::vector<unsigned char> &vch)
+{
+    m_charvec = std::move(vch);
+    set_span();
+}
+
+std::vector<unsigned char> Val64::move_to_valtype()
+{
+    std::vector<unsigned char> ret;
+
+    charvec_change_start();
+    ret = std::move(m_charvec);
+    charvec_change_end();
+
+    return ret;
+}
+
+Val64::Val64()
+{
+    set_span();
+}
+
+Val64::Val64(const Val64 &v)
+{
+    m_charvec = v.m_charvec;
+    set_span();
+}
+
+// Faster "trim zeroes from end" function
+void Val64::trim_tail(size_t nonzero_len)
+{
+#ifdef DEBUG
+    // Check that the words after nonzero len are indeed all zero.
+    for (size_t i = nonzero_len; i < m_u64span.size(); i++) {
+        assert(m_u64span[i] == 0);
+    }
+#endif
+
+    if (nonzero_len < m_u64span.size())
+        m_u64span = m_u64span.first(nonzero_len);
+
+    trim_tail();
+}
+
+void Val64::trim_tail()
+{
+    // We don't care how long it started, just what it could be now.
+    m_realsize = m_u64span.size_bytes();
+
+    charvec_change_start();
+    while (m_charvec.size() > 0 && m_charvec.back() == 0)
+        m_charvec.pop_back();
+    charvec_change_end();
+}
+
+Val64::Val64(uint64_t v) : m_charvec(sizeof(uint64_t))
+{
+    set_span();
+    set(0, v);
+    trim_tail();
+}
+
+// Move constructor
+Val64::Val64(Val64&& other) noexcept:
+    m_charvec(std::move(other.m_charvec))
+{
+    set_span();
+}
+
+// Move assignment operator
+Val64& Val64::operator=(Val64&& other) noexcept {
+    if (this != &other) {
+        other.charvec_change_start();
+        m_charvec = std::move(other.m_charvec);
+        other.charvec_change_end();
+        set_span();
+    }
+    return *this;
+}
+
+void Val64::swap(Val64 &other) noexcept
+{
+    std::swap(m_charvec, other.m_charvec);
+    std::swap(m_realsize, other.m_realsize);
+    std::swap(m_u64span, other.m_u64span);
+}
+
+uint64_t Val64::get_or_zero(size_t index) const
+{
+    if (index >= m_u64span.size())
+        return 0;
+    return get(index);
+}
+
+// Append a 1 byte to the u64ptr array.
+void Val64::append_one()
+{
+    charvec_change_start();
+
+    // Make sure we have room to append.
+    m_charvec.resize(m_u64span.size() * sizeof(uint64_t) + 1);
+    m_charvec[m_u64span.size() * sizeof(uint64_t)] = 1;
+
+    // Re-evaluate with new m_charvec.
+    charvec_change_end();
+}
+
+uint64_t Val64::to_u64_ceil(uint64_t max, size_t &varcost) const
+{
+    uint64_t v;
+
+    // Worst case, we have to examine all bytes.
+    varcost += m_realsize;
+
+    // Little endian: get first word (zero-fills)
+    v = get_or_zero(0);
+    if (v > max)
+        return max;
+
+    // If any other bytes are non-zero, it's > UINT64_MAX.
+    if (m_u64span.size() > 1 && !span_is_allzero(m_u64span.last(m_u64span.size()-1))) {
+        return max;
+    }
+
+    return v;
+}
+
+bool Val64::is_zero(size_t &varcost) const
+{
+    varcost += m_realsize;
+    return span_is_allzero(m_u64span);
+}
+
+bool Val64::span_is_allzero(std::span<le64_t> span)
+{
+    if (span.size() == 0)
+        return true;
+    if (span[0] != 0)
+        return false;
+    // memcmp-with-self trick: see https://rusty.ozlabs.org/2015/10/20/ccanmems-memeqzero-iteration.html
+    return memcmp(span.data(), span.data() + 1, (span.size() - 1) * sizeof(le64_t)) == 0;
+}
+
+// If v1 > v2: 1.  If v1 < v2: -1.  Else 0
+int Val64::cmp_span(std::span<le64_t> v1, std::span<le64_t> v2)
+{
+    size_t maxlen = std::max(v1.size(), v2.size());
+    if (maxlen == 0) return 0;
+
+    for (ptrdiff_t i = maxlen-1; i >= 0; --i) {
+        uint64_t iv1, iv2;
+
+        iv1 = size_t(i) < v1.size() ? le64toh_internal(v1[i]) : 0;
+        iv2 = size_t(i) < v2.size() ? le64toh_internal(v2[i]) : 0;
+        if (iv1 < iv2)
+            return -1;
+        if (iv1 > iv2)
+            return 1;
+    }
+    return 0;
+}
+
+int Val64::cmp(const Val64 &v2, size_t &varcost) const
+{
+    varcost += std::max(m_realsize, v2.m_realsize);
+
+    return cmp_span(m_u64span, v2.m_u64span);
+}
+
+// v1 += v2 (size v2 <= v1).  Return true if carry overflowed.
+bool Val64::add_span(std::span<le64_t> v1, std::span<le64_t> v2,
+                     size_t &nonzero_len)
+{
+    assert(v1.size() >= v2.size());
+
+    // Little endian, overflow forward.
+    bool carry = false;
+
+    size_t i;
+    nonzero_len = 0;
+    for (i = 0; i < v2.size(); ++i) {
+        uint64_t u1, u2, res;
+
+        u1 = le64toh_internal(v1[i]);
+        u2 = le64toh_internal(v2[i]);
+
+        res = u1 + u2 + carry;
+        if (res)
+            nonzero_len = i + 1;
+        v1[i] = htole64_internal(res);
+        if (res > u1)
+            carry = false;
+        else {
+            carry = (res < u1) || (res == u1 && u2 != 0);
+        }
+    }
+
+    /* Carry forwards if required (continue even if not overflowing,
+     * to set nonzero_len) */
+    while (i < v1.size()) {
+        uint64_t u1 = le64toh_internal(v1[i] + carry);
+        v1[i] = htole64_internal(u1);
+        if (u1)
+            nonzero_len = i + 1;
+        carry = carry && (u1 == 0);
+        i++;
+    }
+
+    return carry;
+}
+
+void Val64::op_add(Val64 &v1, Val64 &v2, size_t &varcost)
+{
+    binop_v1_longest(v1, v2);
+
+    // BIP#ops:
+    // |OP_ADD
+    // |Greater of two operand lengths * 4
+    varcost += v1.m_realsize * 4;
+
+    size_t nonzero_len;
+    bool carry = add_span(v1.m_u64span, v2.m_u64span, nonzero_len);
+
+    if (carry) {
+        v1.append_one();
+        return;
+    }
+
+    v1.trim_tail(nonzero_len);
+}
+
+void Val64::op_1add(Val64 &v1, size_t &varcost)
+{
+    Val64 v2(1);
+
+    // BIP#ops:
+    // |OP_1ADD
+    // |MAX(1, operand length) * 3
+
+    // BIP#ops:
+    // OP_1ADD and OP_1SUB are the same cost as ADD/SUB with a minimal 1 operand.
+    op_add(v1, v2, varcost);
+}
+
+// v1 -= v2
+bool Val64::sub_span(std::span<le64_t> v1, std::span<le64_t> v2, size_t &nonzero_len)
+{
+    auto common_len = std::min(v1.size(), v2.size());
+
+    // Little endian, underflow forward.
+    bool underflow = false;
+
+    size_t i;
+    nonzero_len = 0;
+    for (i = 0; i < common_len; ++i) {
+        uint64_t u1, u2, res;
+
+        u1 = le64toh_internal(v1[i]);
+        u2 = le64toh_internal(v2[i]);
+
+        res = u1 - u2 - underflow;
+        v1[i] = htole64_internal(res);
+        if (res)
+            nonzero_len = i + 1;
+        if (res < u1)
+            underflow = false;
+        else {
+            underflow = (res > u1) || (res == u1 && u2 != 0);
+        }
+    }
+
+    /* We have exhausted v1? */
+    if (i < v2.size()) {
+        if (underflow)
+            return underflow;
+        while (i < v2.size()) {
+            if (v2[i] != 0)
+                return true;
+            i++;
+        }
+        return false;
+    }
+
+    /* We have exhausted v2.  Underflow forwards if required: we keep
+     * going even if we don't need to, to update nonzero_len. */
+    while (i < v1.size()) {
+        uint64_t u1 = le64toh_internal(v1[i]);
+        v1[i] = htole64_internal(u1 - underflow);
+        if (v1[i] != 0)
+            nonzero_len = i + 1;
+        underflow = (underflow && u1 == 0);
+        i++;
+    }
+
+    return underflow;
+}
+
+
+bool Val64::op_sub(Val64 &v1, const Val64 &v2, size_t &varcost)
+{
+    // BIP#ops:
+    // |OP_SUB
+    // |Greater of two operand lengths * 3
+    varcost += std::max(v1.m_realsize, v2.m_realsize) * 3;
+    size_t nonzero_len;
+
+    bool underflow = sub_span(v1.m_u64span, v2.m_u64span, nonzero_len);
+    if (underflow)
+        return false;
+
+    v1.trim_tail(nonzero_len);
+    return true;
+}
+
+bool Val64::op_1sub(Val64 &v1, size_t &varcost)
+{
+    const Val64 v2(1);
+
+    return op_sub(v1, v2, varcost);
+}
+
+void Val64::bitshift_down(size_t words, size_t bits)
+{
+    // Not empty
+    assert(m_u64span.size() != 0);
+    assert(bits > 0);
+    assert(bits < 64);
+
+    // [B, A] rshift 1 => [B>>1 | A>>63, A << 1]
+    uint64_t prevbits = get(words) >> bits;
+    for (size_t i = words; i < m_u64span.size() - 1; ++i) {
+        uint64_t next = get(i + 1);
+        uint64_t v = prevbits | (next << (64 - bits));
+        set(i - words, v);
+        prevbits = next >> bits;
+    }
+    // Shift the last word
+    set(m_u64span.size() - 1 - words, prevbits);
+}
+
+void Val64::op_downshift(Val64 &v1, const Val64 &v2, size_t &varcost)
+{
+    uint64_t bits = v2.to_u64_ceil(v1.m_realsize * 8, varcost);
+    size_t bytes = bits / 8;
+
+    // BIP#ops:
+    // |OP_DOWNSHIFT
+    // |Length of BITS + MAX((Length of A - (Value of BITS) / 8), 0) * 2
+
+    // We already added length of BITS in to_u64_ceil above.
+
+    // Shift past end?  Empty.  Also covers empty array.
+    if (bytes >= v1.m_realsize) {
+        v1 = Val64(0);
+        return;
+    }
+
+    // (Length of A - (Value of BITS) / 8) > 0.
+    varcost += (v1.m_realsize - bytes) * 2;
+
+    // Bitwise shifts can't do 0 anyway, as << 64 undefined.
+    if (bits % 8 == 0) {
+        // Remove least-significant words.
+        v1.remove_front(bytes);
+        return;
+    }
+
+    // Size after this is at least 1!
+    assert(v1.m_u64span.size() > 0);
+
+    // We shift and move at the same time.
+    v1.bitshift_down(bits / 64, bits % 64);
+
+    // Truncate.
+    v1.truncate(v1.m_realsize - bytes);
+}
+
+// This means "shift bits higher": number go up!
+bool Val64::op_upshift(Val64 &v1, const Val64 &v2, size_t max_size, size_t &varcost)
+{
+    uint64_t bits = v2.to_u64_ceil(max_size * 8 + 1, varcost);
+
+    // BIP#ops:
+    // |OP_UPSHIFT
+    // ...
+
+    // Cannot overflow: m_realsize is (far) less than 32 bits, so is max_size.
+    if (bits + v1.m_realsize * 8 > max_size * 8)
+        return false;
+
+    // How many whole bytes should we prepend?
+    size_t prebytes = bits / 8;
+
+    // BIP#ops:
+    // |OP_UPSHIFT
+    // |Length of BITS + (Value of BITS) / 8 + Length of A (LENGTHCONV + ZEROING + COPYING).
+    // If BITS % 8 != 0, add (Length of A) * 2.
+    varcost += prebytes + v1.m_realsize;
+
+    if (bits % 8 == 0) {
+        // Simply insert bytes at the beginning.
+        v1.prepend_zeros(prebytes);
+    } else {
+        varcost += v1.m_realsize * 2;
+        // There's no nice C++ "add this many bytes at the beginning,
+        // and one at the end" so we are actually best off prepending too
+        // many bytes (fast!) and shifting backwards.
+        v1.prepend_zeros(prebytes + 1);
+        v1.bitshift_down(0, 8 - (bits % 8));
+    }
+
+    return true;
+}
+
+bool Val64::bitshift_up_small(size_t bits)
+{
+    assert(bits > 0);
+    assert(bits < 64);
+
+    uint64_t prevbits = 0;
+
+    // [B, A] lshift 1 => [B<<1, A<<1 | B >> 63]
+    for (size_t i = 0; i < m_u64span.size(); ++i) {
+        uint64_t old_v = get(i);
+        uint64_t new_v = (old_v << bits) | prevbits;
+
+        set(i, new_v);
+        prevbits = old_v >> (64 - bits);
+    }
+    return (prevbits != 0);
+}
+
+void Val64::op_2mul(Val64 &v1, size_t &varcost)
+{
+    bool carry;
+
+    // BIP#ops:
+    // |OP_2MUL
+    // |Operand length * 3
+    varcost += v1.m_realsize * 3;
+
+    // Trim first: any bytes we trim here, we avoid shifting.
+    v1.trim_tail();
+
+    carry = v1.bitshift_up_small(1);
+
+    if (carry)
+        v1.append_one();
+    else
+        v1.trim_tail();
+}
+
+void Val64::op_2div(Val64 &v1, size_t &varcost)
+{
+    // BIP#ops:
+    // |OP_2DIV
+    // |Operand length
+    varcost += v1.m_realsize * 2;
+
+    // Trim first: any bytes we trim here, we avoid shifting.
+    v1.trim_tail();
+
+    // bitshift_down assumes non-zero size.
+    if (v1.m_realsize == 0)
+        return;
+
+    v1.bitshift_down(0, 1);
+    v1.trim_tail();
+}
+
+void Val64::op_invert(Val64 &v1, size_t &varcost)
+{
+    // BIP#ops:
+    // |OP_INVERT
+    // |(Length of operand) * 2
+    varcost += v1.m_realsize * 2;
+
+    // Endian doesn't matter, so access raw.
+    for (auto &v: v1.m_u64span) {
+        v ^= UINT64_MAX;
+    }
+}
+
+// Makes sure v1 is at least as long as v2.
+void Val64::binop_v1_longest(Val64 &v1, Val64 &v2)
+{
+    // Make sure v1 is the longer one.
+    if (v1.m_realsize < v2.m_realsize)
+        v1.swap(v2);
+}
+
+void Val64::op_and(Val64 &v1, Val64 &v2, size_t &varcost)
+{
+    binop_v1_longest(v1, v2);
+
+    // BIP#ops:
+    // |OP_AND
+    // |Sum of two operand lengths
+    varcost += v1.m_realsize + v2.m_realsize;
+
+    // Endian doesn't matter, so access raw.
+    for (size_t i = 0; i < v2.m_u64span.size(); ++i) {
+        v1.m_u64span[i] &= v2.m_u64span[i];
+    }
+
+    // Rest is 0.
+    std::fill(v1.m_u64span.begin() + v2.m_u64span.size(), v1.m_u64span.end(), 0);
+}
+
+void Val64::op_or(Val64 &v1, Val64 &v2, size_t &varcost)
+{
+    binop_v1_longest(v1, v2);
+
+    // BIP#ops:
+    // |OP_OR
+    // |(Lesser of the two operand lengths) * 2
+    varcost += v2.m_realsize * 2;
+
+    // Endian doesn't matter, so access raw.
+    for (size_t i = 0; i < v2.m_u64span.size(); ++i)
+        v1.m_u64span[i] |= v2.m_u64span[i];
+}
+
+void Val64::op_xor(Val64 &v1, Val64 &v2, size_t &varcost)
+{
+    binop_v1_longest(v1, v2);
+
+    // BIP#ops:
+    // |OP_XOR
+    // |(Lesser of the two operand lengths) * 2
+    varcost += v2.m_realsize * 2;
+
+    // Endian doesn't matter, so access raw.
+    for (size_t i = 0; i < v2.m_u64span.size(); ++i)
+        v1.m_u64span[i] ^= v2.m_u64span[i];
+}
+
+void Val64::op_min(Val64 &v1, Val64 &v2, size_t &varcost)
+{
+    binop_v1_longest(v1, v2);
+
+    // BIP#ops:
+    // |OP_MIN
+    // |(Greater of two operand lengths) * 2
+    varcost += v1.m_realsize * 2;
+
+    if (cmp_span(v1.m_u64span, v2.m_u64span) > 0) {
+        v1 = std::move(v2);
+    }
+    v1.trim_tail();
+}
+
+void Val64::op_max(Val64 &v1, Val64 &v2, size_t &varcost)
+{
+    binop_v1_longest(v1, v2);
+
+    // BIP#ops:
+    // |OP_MAX
+    // |(Greater of two operand lengths) * 2
+    varcost += v1.m_realsize * 2;
+
+    if (cmp_span(v1.m_u64span, v2.m_u64span) < 0) {
+        v1 = std::move(v2);
+    }
+    v1.trim_tail();
+}
+
+void Val64::mul_span(std::span<le64_t> res,
+                     std::span<le64_t> src,
+                     uint64_t mul)
+{
+    // Result must be (at least) 1 word larger, for carry.
+    assert(res.size() >= src.size() + 1);
+
+    // Calculate this * mul, into res.
+    res[0] = htole64_internal(0);
+    for (size_t i = 0; i < src.size(); ++i) {
+        uint64_t hi, lo, oldhi;
+
+        // Take advantage of 64 bit multiplier if platform has it
+#if defined(__SIZEOF_INT128__)
+        if (!force_portable_math) {
+            unsigned __int128 product;
+            product = ((unsigned __int128)(le64toh_internal(src[i]))) * mul;
+            hi = static_cast<uint64_t>(product >> 64);
+            lo = static_cast<uint64_t>(product & (unsigned __int128)UINT64_MAX);
+
+            oldhi = le64toh_internal(res[i]);
+            /* Note: hi cannot overflow since UINT64MAX * UINT64MAX
+             * gives an upper u64 which is < UINT64MAX. */
+#ifdef __has_builtin
+#if __has_builtin(__builtin_add_overflow)
+            if (__builtin_add_overflow(lo, oldhi, &lo))
+                hi++;
+#else
+            // Fallback without __builtin_add_overflow
+            uint64_t new_lo = lo + oldhi;
+            if (new_lo < lo)  // overflow in addition
+                hi++;
+            lo = new_lo;
+#endif
+#else
+            // Fallback for compilers without __has_builtin
+            uint64_t new_lo = lo + oldhi;
+            if (new_lo < lo)  // overflow in addition
+                hi++;
+            lo = new_lo;
+#endif
+        } else
+#endif
+        {
+            // Portable fallback: 64x64->128 bit multiplication
+            uint64_t a = le64toh_internal(src[i]);
+            uint64_t a_lo = a & 0xFFFFFFFFULL;
+            uint64_t a_hi = a >> 32;
+            uint64_t b_lo = mul & 0xFFFFFFFFULL;
+            uint64_t b_hi = mul >> 32;
+
+            uint64_t p0 = a_lo * b_lo;
+            uint64_t p1 = a_lo * b_hi;
+            uint64_t p2 = a_hi * b_lo;
+            uint64_t p3 = a_hi * b_hi;
+
+            uint64_t carry = ((p0 >> 32) + (p1 & 0xFFFFFFFFULL) + (p2 & 0xFFFFFFFFULL)) >> 32;
+            lo = p0 + (p1 << 32) + (p2 << 32);
+            hi = p3 + (p1 >> 32) + (p2 >> 32) + carry;
+
+            oldhi = le64toh_internal(res[i]);
+            uint64_t new_lo = lo + oldhi;
+            if (new_lo < lo)  // overflow in addition
+                hi++;
+            lo = new_lo;
+        }
+        res[i] = htole64_internal(lo);
+        res[i+1] = htole64_internal(hi);
+    }
+}
+
+Val64 Val64::op_mul(Val64 &v1, Val64 &v2)
+{
+    // Slightly more optimal if v1 is the larger operand.
+    binop_v1_longest(v1, v2);
+
+    // Result (worst case is sum of operand lengths)
+    std::vector<unsigned char> retvec((v1.m_u64span.size() + v2.m_u64span.size()) * sizeof(uint64_t));
+    Val64 ret(retvec);
+
+    // Result of each v1[] * v2.
+    std::vector<le64_t> scratch(v2.m_u64span.size() + 1);
+
+    size_t ret_nonzero_len = 0;
+
+    for (size_t i = 0; i < v1.m_u64span.size(); i++) {
+        size_t nonzero_len;
+        // Multiply v2 by v1[i] into scratch.
+        mul_span(scratch, v2.m_u64span, v1.get(i));
+
+        // Now add into result at offset i.
+        // Cannot overflow.  Worst case ret effectively adds 1 to v1[i],
+        // which *still* doesn't quite overflow.
+        bool carry = add_span(ret.m_u64span.subspan(i, v2.m_u64span.size() + 1),
+                              scratch, nonzero_len);
+        assert(!carry);
+        if (nonzero_len)
+            ret_nonzero_len = i + nonzero_len;
+    }
+
+    ret.trim_tail(ret_nonzero_len);
+    return ret;
+}
+
+// False iff v2 is 0.
+bool Val64::div_mod(Val64 &v1, Val64 &v2, divmod_op op)
+{
+    // This is BasecaseDivRem from "Modern Computer Arithmetic" by Richard
+    // Brent and Paul Zimmerman.  I discovered later that this is the same as
+    // Knuth's TAOCP v2 (of course!) page 272, Algorithm D "Division of
+    // non-negative integers".
+
+    // For efficiency, the divisor (v2) needs to be *normalized*, i.e.
+    // the top bit is set.  We trim and shift both to ensure this is true.
+
+    // Note: this doesn't cost cost anything!  This is because any
+    // bytes trimmed here (cost == number of bytes trimmed + 1) saves
+    // costs below.
+    v1.trim_tail();
+    v2.trim_tail();
+
+    // BIP#ops:
+    // |OP_DIV
+    //...
+    // If B is empty or all zeroes, fail.
+    //...
+    // |OP_MOD
+    //...
+    // If B is empty or all zeroes, fail.
+
+    // Now there's only one canonical zero.
+    if (v2.m_realsize == 0)
+        return false;
+
+    // How many bits do we have to shift to get top bit set?
+    size_t k = std::countl_zero(v2.get(v2.m_u64span.size()-1));
+
+    if (v1.m_realsize < v2.m_realsize) {
+        // v2 > v1: v1 is remainder, quotient is 0.
+        if (op == divmod_op::VAL64_DIV)
+            v1 = Val64(0);
+        return true;
+    }
+
+    // These might have to reallocate, but by no more than 8 bytes.
+    // In theory, we could save this cost by doing shifting as we go.
+    // But this shift isn't really the main overhead, so keep it simple.
+    if (k != 0) {
+        size_t varcost;
+        // FIXME: create upshift which takes size_t to avoid Val64(k) here!
+        op_upshift(v1, Val64(k), v1.m_realsize + sizeof(uint64_t), varcost);
+        bool overflow = v2.bitshift_up_small(k);
+        assert(!overflow);
+    }
+
+    // Shift can add a few zero bytes, re-normalize.
+    v1.trim_tail();
+    v2.trim_tail();
+
+    // v1 has n+m words, v2 has n words.  β is the base (2^64 here).
+    assert(v1.m_u64span.size() >= v2.m_u64span.size());
+    size_t n = v2.m_u64span.size();
+    size_t m = v1.m_u64span.size() - n;
+
+    // If we need quotient, create empty q vec, worst-case len.
+    Val64 q;
+    if (op == divmod_op::VAL64_DIV) {
+        std::vector<unsigned char> qvec((m + 1) * sizeof(uint64_t));
+        q.move_from_valtype(qvec);
+    }
+
+    // 1: if v1 >= β^m x v2, then q_m = 1, v1 = v1 - β^m x v2 else q_m = 0
+    if (cmp_span(v1.m_u64span.subspan(m), v2.m_u64span) > -1) {
+        size_t last_nonzero;
+        if (op == divmod_op::VAL64_DIV)
+            q.set(m, 1);
+        bool carry = sub_span(v1.m_u64span.subspan(m), v2.m_u64span, last_nonzero);
+        assert(!carry);
+    } else {
+        if (op == divmod_op::VAL64_DIV)
+            q.set(m, 0);
+    }
+
+    // We need a temporary, but we overwrite it all, so create outside loop.
+    std::vector<le64_t> scratch((v2.m_u64span.size() + 1) * sizeof(uint64_t));
+
+    // 2: for j from m-1 downto 0 do:
+    for (ptrdiff_t j = m - 1; j >= 0; j--) {
+        // 3: q* = floor((v1_n+j_ x β + v1_n+j-1_) / v2_n-1_)
+        uint64_t qstar;
+        uint64_t rstar;
+
+#if defined(__SIZEOF_INT128__)
+        if (!force_portable_math) {
+            unsigned __int128 v;
+            unsigned __int128 qstar128;
+            unsigned __int128 rstar128;
+
+            v = ((unsigned __int128)v1.get(n+j)) << 64 | v1.get(n+j-1);
+            qstar128 = v / v2.get(n-1);
+
+            // Knuth suggests: (notation reworked to match us, the rest is a
+            // direct quote):
+
+            // ... let r* be the remainder.
+            // Now test if q* == β, or q* x v2_n-2_ > βr* + v1_n+j-2_:
+            // if so, decrease q* by 1, increase r* by v2_n-1_, and
+            // repeat this test if r* < β. (The test on v2_n-2_ determines at
+            // high speed most of the cases in which the trial value q* is
+            // one too large, and it eliminates /all/ cases where q* is
+            // two too large
+            rstar128 = v % v2.get(n-1);
+
+            if ((qstar128 >> 64) != 0
+                || (n > 1 && qstar128 * v2.get(n-2)
+                    > (rstar128 << 64) + v1.get(n+j-2))) {
+                qstar128--;
+                rstar128 += v2.get(n-1);
+                if ((rstar128 >> 64) == 0
+                    && (n > 1 && qstar128 * v2.get(n-2)
+                        > (rstar128 << 64) + v1.get(n+j-2))) {
+                    qstar128--;
+                }
+            }
+            qstar = static_cast<uint64_t>(qstar128);
+            rstar = static_cast<uint64_t>(rstar128);
+        } else
+#endif
+        {
+            // Portable 128-bit by 64-bit division using 32-bit digits.
+            // Based on Hacker's Delight divlu() and Knuth's Algorithm D.
+            // Computes (v_hi:v_lo) / divisor where v_hi < divisor (guaranteed
+            // since divisor is normalized with top bit set).
+            uint64_t v_hi = v1.get(n+j);
+            uint64_t v_lo = v1.get(n+j-1);
+            uint64_t divisor = v2.get(n-1);
+
+            if (v_hi >= divisor) {
+                // Quotient would overflow 64 bits
+                qstar = UINT64_MAX;
+                rstar = v_hi - divisor; // Not accurate but will be corrected
+            } else if (v_hi == 0) {
+                // Simple case: dividend fits in 64 bits
+                qstar = v_lo / divisor;
+                rstar = v_lo % divisor;
+            } else {
+                // 128-bit by 64-bit division using 32-bit digit long division.
+                // The divisor has its top bit set (normalized), so we can safely
+                // use 32-bit chunks without overflow in intermediate calculations.
+                constexpr uint64_t B = 1ULL << 32; // Base (2^32)
+
+                // Split divisor into two 32-bit digits
+                uint64_t d1 = divisor >> 32;      // High 32 bits of divisor
+                uint64_t d0 = divisor & 0xFFFFFFFF; // Low 32 bits of divisor
+
+                // The dividend is (v_hi : v_lo), treat as 4 32-bit digits:
+                // v_hi = (u3 : u2), v_lo = (u1 : u0)
+                // We compute quotient one 32-bit digit at a time.
+
+                // First quotient digit q1: divide (v_hi : high32(v_lo)) by divisor
+                // Since divisor is normalized and v_hi < divisor, we know the result fits in 32 bits.
+                uint64_t u32 = v_hi; // This is the top 64 bits of the 96-bit partial dividend
+                uint64_t u1 = v_lo >> 32;
+                uint64_t u0 = v_lo & 0xFFFFFFFF;
+
+                // Estimate q1 = floor(u32 / d1)
+                uint64_t q1 = u32 / d1;
+                uint64_t r1 = u32 % d1;
+
+                // Refine: while q1 >= B or q1 * d0 > B * r1 + u1
+                while (q1 >= B || q1 * d0 > (r1 << 32) + u1) {
+                    q1--;
+                    r1 += d1;
+                    if (r1 >= B) break;
+                }
+
+                // Update partial remainder for next digit
+                // u21 = (u32 * B + u1) - q1 * divisor
+                // Note: u32 * B would overflow, but we can compute:
+                // (r1 * B + u1) - q1 * d0 since u32 = q1 * d1 + r1
+                // Actually: u21 = (r1 << 32) + u1 - q1 * d0
+                // But we need to be careful about underflow.
+                // Safer: u21 = u32 * B + u1 - q1 * divisor
+                //           = (q1 * d1 + r1) * B + u1 - q1 * (d1 * B + d0)
+                //           = q1 * d1 * B + r1 * B + u1 - q1 * d1 * B - q1 * d0
+                //           = r1 * B + u1 - q1 * d0
+                uint64_t u21 = (r1 << 32) + u1 - q1 * d0;
+
+                // Second quotient digit q0: divide (u21 : u0) by divisor
+                uint64_t q0 = u21 / d1;
+                uint64_t r0 = u21 % d1;
+
+                // Refine q0
+                while (q0 >= B || q0 * d0 > (r0 << 32) + u0) {
+                    q0--;
+                    r0 += d1;
+                    if (r0 >= B) break;
+                }
+
+                qstar = (q1 << 32) + q0;
+                // Remainder = (r0 << 32) + u0 - q0 * d0
+                rstar = (r0 << 32) + u0 - q0 * d0;
+            }
+
+            // Apply Knuth's test on v2[n-2] if available
+            if (n > 1) {
+                uint64_t v2_n2 = v2.get(n-2);
+                uint64_t v1_nj2 = v1.get(n+j-2);
+                uint64_t divisor = v2.get(n-1);
+                // Test: if qstar * v2[n-2] > (rstar << 64) + v1[n+j-2]
+                // Since rstar < divisor and divisor has top bit set, rstar < 2^63,
+                // so if (rstar >> 63) != 0, the condition is false.
+                while ((rstar >> 63) == 0) {
+                    // Compute qstar * v2_n2 as 128-bit (prod_hi:prod_lo)
+                    uint64_t prod_lo = qstar * v2_n2;
+                    // For high part, use: a*b = (a_hi*B + a_lo)*(b_hi*B + b_lo)
+                    // High 64 bits of 64x64->128 multiply:
+                    uint64_t a_hi = qstar >> 32;
+                    uint64_t a_lo = qstar & 0xFFFFFFFF;
+                    uint64_t b_hi = v2_n2 >> 32;
+                    uint64_t b_lo = v2_n2 & 0xFFFFFFFF;
+                    // Note: a_hi * b_lo + a_lo * b_hi can overflow uint64_t,
+                    // so we must track the carry separately.
+                    uint64_t p1 = a_hi * b_lo;
+                    uint64_t p2 = a_lo * b_hi;
+                    uint64_t cross = p1 + p2;
+                    uint64_t cross_carry = (cross < p1) ? (1ULL << 32) : 0;
+                    uint64_t prod_hi = a_hi * b_hi + (cross >> 32) + cross_carry;
+                    // Add carry from cross + (a_lo * b_lo >> 32)
+                    uint64_t lo_cross = (a_lo * b_lo >> 32) + (cross & 0xFFFFFFFF);
+                    prod_hi += (lo_cross >> 32);
+
+                    // Compare (prod_hi:prod_lo) > (rstar:v1_nj2)
+                    if (prod_hi > rstar || (prod_hi == rstar && prod_lo > v1_nj2)) {
+                        qstar--;
+                        rstar += divisor;
+                        // If rstar overflowed (>= 2^64), stop
+                        if (rstar < divisor) break;
+                    } else {
+                        break;
+                    }
+                }
+            }
+        }
+
+        // This is our (64-bit) guess.
+        uint64_t qj = qstar;
+
+        // D4: v1 = v1 - q_j_ x β^j x v2
+
+        // Assign scratch = q_j_ x v2
+        // Note: v2 doesn't change in this loop, so scratch gets fully
+        // overwritten each time, meaning we don't need to zero it.
+        mul_span(scratch, v2.m_u64span, qj);
+
+        bool underflow;
+        size_t last_nonzero;
+        underflow = sub_span(v1.m_u64span.subspan(j), scratch, last_nonzero);
+        // D5: Set q_j_ = q*.  If the result of D4 was negative, go to D6.
+        if (underflow) {
+            // D6: Decrease q_j_ by 1, and add β^j x v2 to v1
+
+            // FIXME: As Knuth points out, this is a hard to hit case:
+            // solve Exercise 21 so we can test the damn thing!
+
+            // Intuitively: we've got an estimate on v1/v2, using division on
+            // the high words, plus a compensation from the next-highest.  It
+            // could be an overestimate by one, however!
+            qj--;
+            bool carry;
+            size_t nonzero_len;
+            carry = add_span(v1.m_u64span.subspan(j), v2.m_u64span, nonzero_len);
+            assert(carry);
+        }
+
+        // Keep shrinking v1.  Note: we could use the sub/add_with_offset
+        // return to trim a bit faster if we wanted.
+        if (v1.m_u64span.size() > 0) {
+            assert(v1.get(v1.m_u64span.size()-1) == 0);
+            v1.truncate((v1.m_u64span.size()-1) * sizeof(uint64_t));
+        }
+
+        if (op == divmod_op::VAL64_DIV)
+            q.set(j, qj);
+    }
+
+    switch (op) {
+    case divmod_op::VAL64_MOD:
+        // Remainder needs shifting back (quotient is unaffected, since
+        // (A * N) / (B * N) == A / B).
+        if (k != 0 && v1.m_realsize != 0)
+            v1.bitshift_down(0, k);
+        v1.trim_tail();
+        return true;
+    case divmod_op::VAL64_DIV:
+        v1 = std::move(q);
+        v1.trim_tail();
+        return true;
+    }
+    assert(!"Invalid op");
+}
+
+bool Val64::op_div(Val64 &v1, Val64 &v2)
+{
+    return div_mod(v1, v2, divmod_op::VAL64_DIV);
+}
+
+bool Val64::op_mod(Val64 &v1, Val64 &v2)
+{
+    return div_mod(v1, v2, divmod_op::VAL64_MOD);
+}
+
+size_t Val64::op_mul_varcost(const Val64 &v1, const Val64 &v2)
+{
+    // BIP#ops:
+    // |OP_MUL
+    // |Length of A + length of B + (length of A + 7) / 8 * (length of B) * 6
+    //  (BEWARE OVERFLOW)
+    return v1.m_realsize + v2.m_realsize + (v1.m_realsize + 7) / 8 * uint64_t(v2.m_realsize) * 6;
+}
+
+size_t Val64::op_div_varcost(const Val64 &v1, const Val64 &v2)
+{
+    // BIP#ops:
+    // |OP_DIV
+    // |Length of A * 9 + length of B * 2 + (length of A)^2 / 3  (BEWARE OVERFLOW)
+    return v1.m_realsize * 9 + v2.m_realsize * 2
+        + uint64_t(v1.m_realsize) * uint64_t(v1.m_realsize) / 3;
+}
+
+size_t Val64::op_mod_varcost(const Val64 &v1, const Val64 &v2)
+{
+    // BIP#ops:
+    // |OP_MOD
+    // |Length of A * 9 + length of B * 2 + (length of A)^2 / 4  (BEWARE OVERFLOW)
+    return v1.m_realsize * 9 + v2.m_realsize * 2
+        + uint64_t(v1.m_realsize) * uint64_t(v1.m_realsize) / 4;
+}
diff --git a/src/script/val64.h b/src/script/val64.h
new file mode 100644
index 000000000000..768d702c30fb
--- /dev/null
+++ b/src/script/val64.h
@@ -0,0 +1,198 @@
+// Copyright (c) 2024 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+#ifndef BITCOIN_SCRIPT_VAL64_H
+#define BITCOIN_SCRIPT_VAL64_H
+
+#include <cstddef>
+#include <cstdint>
+#include <vector>
+#include <span.h>
+#include <compat/endian.h>
+
+/**
+ * This class is used for all modern taproot ops: this is
+ * much more efficient for bit and arithmetic ops on large values.
+ * In practice, vectors are always aligned (and x86 doesn't care anyway),
+ * but we handle unaligned case by copying if required.
+ */
+class Val64 {
+protected:
+    // Convenience typedef for clarity, where dealing with little-endian.
+    typedef uint64_t le64_t;
+
+    // The underlying vector (moved in and out).
+    std::vector<unsigned char> m_charvec;
+
+    // The size of the raw data we want.
+    size_t m_realsize;
+
+    // The span inside m_charvec, as little-endian uint64_t.
+    std::span<le64_t> m_u64span;
+
+    // Helper to set other fields after m_charvec is set.
+    void set_span();
+
+    // Helpers to alter m_charvec.
+    void charvec_change_start();
+    void charvec_change_end();
+
+    // Are we actually offset within m_charvec?
+    size_t u64ptr_off() const;
+
+    // Append a 1 byte to the value (for carry)
+    void append_one();
+
+    // Remove this many bytes from the front.
+    void remove_front(size_t bytes);
+
+    // Prepend this many zero bytes to the front.
+    void prepend_zeros(size_t prebytes);
+
+    // Trim to this length.
+    void truncate(size_t new_realsize);
+
+public:
+    Val64();
+    Val64(std::vector<unsigned char> &v);
+
+    // Make a (minimal) val64 from a uint64_t
+    explicit Val64(uint64_t v);
+
+    // Move constructor
+    Val64(Val64&& other) noexcept;
+    // Move assignment operator
+    Val64& operator=(Val64&& other) noexcept;
+
+    void move_from_valtype(std::vector<unsigned char> &vch);
+
+    // Convert to a valtype: CLEARS THE VAL64!
+    std::vector<unsigned char> move_to_valtype();
+
+    // &varcost here is always increased by the operation.
+
+    // Convert to a 64 bit, or max if it's too large.
+    uint64_t to_u64_ceil(uint64_t max, size_t &varcost) const;
+
+    // Invert this to convert to boolean.
+    bool is_zero(size_t &varcost) const;
+
+    // Returns -1 if this < v2, 0 if equal, 1 if this > v2.
+    int cmp(const Val64 &v2, size_t &varcost) const;
+
+    // We use explicit names here, to show that these are *not* generic operations, but consensus constrained.
+    static void op_add(Val64 &v1, Val64 &v2, size_t &varcost);
+    static void op_1add(Val64 &v1, size_t &varcost);
+
+    // if v1 < v2: returns false, mangles v1.
+    // otherwise: returns true, sets v1 to v1 - v2.
+    static bool op_sub(Val64 &v1, const Val64 &v2, size_t &varcost);
+    static bool op_1sub(Val64 &v1, size_t &varcost);
+
+    // Returns false if v1 would exceed max_size.
+    static bool op_upshift(Val64 &v1, const Val64 &v2, size_t max_size, size_t &varcost);
+    static void op_downshift(Val64 &v1, const Val64 &v2, size_t &varcost);
+
+    // Like shift 1, but normalize.
+    static void op_2mul(Val64 &v1, size_t &varcost);
+    static void op_2div(Val64 &v1, size_t &varcost);
+
+    static void op_invert(Val64 &v1, size_t &varcost);
+
+    static void op_and(Val64 &v1, Val64 &v2, size_t &varcost);
+    static void op_or(Val64 &v1, Val64 &v2, size_t &varcost);
+    static void op_xor(Val64 &v1, Val64 &v2, size_t &varcost);
+
+    static void op_min(Val64 &v1, Val64 &v2, size_t &varcost);
+    static void op_max(Val64 &v1, Val64 &v2, size_t &varcost);
+
+    // These three are potentially v. expensive, so we must
+    // check varops varcost *before* we evaluate them:
+    static size_t op_mul_varcost(const Val64 &v1, const Val64 &v2);
+    static size_t op_div_varcost(const Val64 &v1, const Val64 &v2);
+    static size_t op_mod_varcost(const Val64 &v1, const Val64 &v2);
+
+    // Non-const, since might switch variables.
+    static Val64 op_mul(Val64 &v1, Val64 &v2);
+
+    // Returns false if v2 is 0.
+    static bool op_div(Val64 &v1, Val64 &v2);
+    static bool op_mod(Val64 &v1, Val64 &v2);
+
+private:
+    static void warn_alignment_once(const void *p, size_t len);
+
+protected:
+    // Copy constructor, useful for tests.
+    Val64(const Val64 &);
+
+    // Swap with the other value
+    void swap(Val64& other) noexcept;
+
+    // Endian fixers - inline for performance
+    inline void set(size_t index, uint64_t v)
+    {
+        m_u64span[index] = htole64_internal(v);
+    }
+
+    inline uint64_t get(size_t index) const
+    {
+        return le64toh_internal(m_u64span[index]);
+    }
+
+    // If it's past the end, return 0.
+    uint64_t get_or_zero(size_t index) const;
+
+    // We've treated this as a u64 array, now trim trailing zero bytes.
+    void trim_tail();
+
+    // Fast version, if we know some zeros already.
+    void trim_tail(size_t nonzero_len);
+
+    // Swap v1 and v2 so v1 is always longer or same size than v2.
+    static void binop_v1_longest(Val64 &v1, Val64 &v2);
+
+    // Right shift by this many words, and this many bits (1-63 incl).
+    void bitshift_down(size_t words, size_t bits);
+
+    // Left shift in place by this many bits (1-64 incl)
+    // Return true iff we had overflow.
+    bool bitshift_up_small(size_t bits);
+
+    // False if any non-zero bytes in span.
+    static bool span_is_allzero(std::span<le64_t> span);
+
+    // (*this) cmp (v2 << shift_words*64)
+    static int cmp_span(std::span<le64_t> v1, std::span<le64_t> v2);
+
+    // v1 += v2, return carry.  v1.size() >= v2.size().
+    // If returns false, nonzero_len is one past the last non-zero u64 in v1
+    // (which helps optimize trim_tail)
+    static bool add_span(std::span<uint64_t> v1, std::span<uint64_t> v2, size_t &nonzero_len);
+
+    // v1 -= v2, returns underflow.
+    // If returns false, nonzero_len is one past the last non-zero u64 in v1
+    // (which helps optimize trim_tail)
+    static bool sub_span(std::span<le64_t> v1, std::span<le64_t> v2, size_t &nonzero_len);
+
+    // res = src * mul
+    static void mul_span(std::span<le64_t> res,
+                         std::span<le64_t> src,
+                         uint64_t mul);
+
+    enum class divmod_op {
+        VAL64_DIV,
+        VAL64_MOD,
+    };
+
+    // Div: v1 = v1 / v2.  Mod: v1 = v1 % v2.  False if v2 is zero.
+    static bool div_mod(Val64 &v1, Val64 &v2, divmod_op op);
+
+    // Test helpers
+    static bool force_unaligned;
+    static bool force_portable_math;
+public:
+    static bool suppress_alignment_warnings;
+};
+
+#endif // BITCOIN_SCRIPT_VAL64_H
diff --git a/src/script/valtype_stack.cpp b/src/script/valtype_stack.cpp
new file mode 100644
index 000000000000..57d4c33a7498
--- /dev/null
+++ b/src/script/valtype_stack.cpp
@@ -0,0 +1,175 @@
+// Copyright (c) 2025 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/valtype_stack.h>
+#include <stdexcept>
+
+ValtypeStack::ValtypeStack(const ValtypeStack& other) : stack(other.stack) {
+    recalculate_size_tracking();
+}
+
+ValtypeStack::ValtypeStack(ValtypeStack&& other) noexcept : stack(std::move(other.stack)) {
+    recalculate_size_tracking();
+}
+
+ValtypeStack::ValtypeStack(const std::vector<std::vector<unsigned char>>& plain_stack) : stack(plain_stack) {
+    recalculate_size_tracking();
+}
+
+ValtypeStack& ValtypeStack::operator=(const ValtypeStack& other) {
+    if (this != &other) {
+        stack = other.stack;
+        recalculate_size_tracking();
+    }
+    return *this;
+}
+
+ValtypeStack& ValtypeStack::operator=(ValtypeStack&& other) noexcept {
+    if (this != &other) {
+        stack = std::move(other.stack);
+        recalculate_size_tracking();
+    }
+    return *this;
+}
+
+ValtypeStack& ValtypeStack::operator=(const std::vector<std::vector<unsigned char> >& plain_stack) {
+    stack = plain_stack;
+    recalculate_size_tracking();
+    return *this;
+}
+
+void ValtypeStack::push_back(const std::vector<unsigned char>& element) {
+    update_size_tracking(element, true);
+    stack.push_back(element);
+}
+
+void ValtypeStack::push_back(std::vector<unsigned char>&& element) {
+    update_size_tracking(element, true);
+    stack.push_back(std::move(element));
+}
+
+void ValtypeStack::pop_back() {
+    if (!stack.empty()) {
+        update_size_tracking(stack.back(), false);
+        stack.pop_back();
+    }
+}
+
+std::vector<unsigned char> ValtypeStack::pop_back_valtype() {
+    if (stack.empty()) {
+        throw std::runtime_error("pop_back_valtype(): stack empty");
+    }
+    update_size_tracking(stack.back(), false);
+    std::vector<unsigned char> result = std::move(stack.back());
+    stack.pop_back();
+    return result;
+}
+
+bool ValtypeStack::pop64(Val64 &v, std::optional<size_t> index /* = std::nullopt */) {
+    if (stack.empty())
+        return false;
+
+    // if no index provided, pop from the back (last element)
+    const size_t index_to_pop = index.value_or(stack.size() - 1);
+
+    update_size_tracking(stack.at(index_to_pop), false);
+    v.move_from_valtype(stack.at(index_to_pop));
+    stack.erase(stack.begin() + index_to_pop);
+    return true;
+}
+
+void ValtypeStack::clear() {
+    stack.clear();
+    total_size = 0;
+    max_element_size = 0;
+}
+
+void ValtypeStack::erase(size_t n) {
+    if (n > stack.size()) {
+        n = stack.size();
+    }
+    update_size_tracking(stack[n], false);
+    stack.erase(stack.begin() + n);
+}
+
+void ValtypeStack::erase(size_t first, size_t last) {
+    if (first >= last || last > stack.size()) {
+        throw std::invalid_argument("Invalid range");
+    }
+
+    for (size_t i = first; i < last; ++i) {
+        update_size_tracking(stack[i], false);
+    }
+    stack.erase(stack.begin() + first, stack.begin() + last);
+}
+
+void ValtypeStack::insert(size_t index, const std::vector<unsigned char>& element) {
+    if (index > stack.size()) {
+        throw std::invalid_argument("Invalid index");
+    }
+
+    update_size_tracking(element, true);
+    stack.insert(stack.begin() + index, element);
+}
+
+void ValtypeStack::reserve(size_t n) {
+    stack.reserve(n);
+}
+
+void ValtypeStack::resize(size_t n) {
+    while (stack.size() > n) {
+        pop_back();
+    }
+    while (stack.size() < n) {
+        stack.emplace_back();
+    }
+}
+
+void ValtypeStack::rotate(int a, int b, int c) {
+    std::rotate(stack.end() + a, stack.end() + b, stack.end() + c);
+}
+
+// more efficient than std::rotate
+void ValtypeStack::roll(size_t n) {
+    // rotate start, newstart, end.
+    auto element = std::move(stack[stack.size() - n - 1]);
+    stack.erase(stack.begin() + stack.size() - n - 1);
+    stack.push_back(std::move(element));
+}
+
+void ValtypeStack::swap(int a, int b) {
+    std::swap(stack.at(static_cast<size_t>(static_cast<ptrdiff_t>(stack.size()) + a)),
+              stack.at(static_cast<size_t>(static_cast<ptrdiff_t>(stack.size()) + b)));
+}
+
+size_t ValtypeStack::get_total_size() const {
+    return total_size;
+}
+
+size_t ValtypeStack::get_max_element_size() const {
+    return max_element_size;
+}
+
+size_t ValtypeStack::total_stack_size(size_t &max_size) const {
+    max_size = std::max(max_size, get_max_element_size());
+    return get_total_size();
+}
+
+void ValtypeStack::update_size_tracking(const std::vector<unsigned char>& element, bool add) {
+    if (add) {
+        total_size += element.size();
+        max_element_size = std::max(max_element_size, element.size());
+    } else {
+        total_size -= element.size();
+    }
+}
+
+void ValtypeStack::recalculate_size_tracking() {
+    total_size = 0;
+    max_element_size = 0;
+    for (const auto& element : stack) {
+        total_size += element.size();
+        max_element_size = std::max(max_element_size, element.size());
+    }
+}
diff --git a/src/script/valtype_stack.h b/src/script/valtype_stack.h
new file mode 100644
index 000000000000..dccafeb93813
--- /dev/null
+++ b/src/script/valtype_stack.h
@@ -0,0 +1,80 @@
+// Copyright (c) 2025 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+#ifndef BITCOIN_SCRIPT_VALTYPE_STACK_H
+#define BITCOIN_SCRIPT_VALTYPE_STACK_H
+
+#include <script/val64.h>
+#include <vector>
+#include <algorithm>
+#include <cassert>
+#include <map>
+#include <optional>
+
+typedef std::vector<unsigned char> valtype;
+
+/**
+ * Script stack wrapper that internally tracks element size counts for efficient
+ * calculation of total stack size and maximum element size. This avoids the need
+ * to iterate through all elements during script execution.
+ */
+class ValtypeStack {
+public:
+    // Constructors and assignment operators
+    ValtypeStack() = default;
+    ValtypeStack(const ValtypeStack& other);
+    ValtypeStack(ValtypeStack&& other) noexcept;
+    ValtypeStack(const std::vector<std::vector<unsigned char>>& plain_stack);
+
+    ValtypeStack& operator=(const ValtypeStack& other);
+    ValtypeStack& operator=(ValtypeStack&& other) noexcept;
+    ValtypeStack& operator=(const std::vector<std::vector<unsigned char>>& plain_stack);
+
+    const valtype& at(size_t n) const { return stack.at(n); }
+
+    // Const iterator support
+    typename std::vector<std::vector<unsigned char>>::const_iterator begin() { return stack.begin(); }
+    typename std::vector<std::vector<unsigned char>>::const_iterator begin() const { return stack.begin(); }
+    typename std::vector<std::vector<unsigned char>>::const_iterator end() { return stack.end(); }
+    typename std::vector<std::vector<unsigned char>>::const_iterator end() const { return stack.end(); }
+
+    const std::vector<std::vector<unsigned char>>& get_stack() const { return stack; }
+
+    // Stack interface methods that need size tracking
+    void push_back(const std::vector<unsigned char>& element);
+    void push_back(std::vector<unsigned char>&& element);
+    void pop_back();
+    std::vector<unsigned char> pop_back_valtype();  // Returns the popped element by value
+    bool pop64(Val64 &v, std::optional<size_t> index = std::nullopt);
+    void clear();
+
+    void erase(size_t n);  // Erase the element at position n
+    void erase(size_t first, size_t last);  // Erase the range of elements [first, last)
+    void insert(size_t index, const std::vector<unsigned char>& element);  // Insert element at index position
+
+    void reserve(size_t n);
+    void resize(size_t n);
+
+    void rotate(int a, int b, int c);
+    void roll(size_t n);
+    void swap(int a, int b);
+
+    size_t get_total_size() const;
+    size_t get_max_element_size() const;
+    size_t total_stack_size(size_t &max_size) const;
+
+    size_t size() const { return stack.size(); }
+    bool empty() const { return stack.empty(); }
+    const std::vector<unsigned char>& back() const { return stack.back(); }
+    const std::vector<unsigned char>& front() const { return stack.front(); }
+
+private:
+    std::vector<std::vector<unsigned char>> stack;
+    size_t total_size = 0;
+    size_t max_element_size = 0;  // Maximum element size the stack has ever seen, is not updated when elements are removed
+
+    void update_size_tracking(const std::vector<unsigned char>& element, bool add);
+    void recalculate_size_tracking();
+};
+
+#endif // BITCOIN_SCRIPT_VALTYPE_STACK_H
diff --git a/src/test/CMakeLists.txt b/src/test/CMakeLists.txt
index 3ec1a8a39b4b..dbe11f53adf7 100644
--- a/src/test/CMakeLists.txt
+++ b/src/test/CMakeLists.txt
@@ -88,6 +88,8 @@ add_executable(test_bitcoin
   script_segwit_tests.cpp
   script_standard_tests.cpp
   script_tests.cpp
+  valtype_stack_tests.cpp
+  gsr_tests.cpp
   scriptnum_tests.cpp
   serfloat_tests.cpp
   serialize_tests.cpp
@@ -133,9 +135,12 @@ target_json_data_sources(test_bitcoin
   data/key_io_invalid.json
   data/key_io_valid.json
   data/script_tests.json
+  data/gsr_tests.json
   data/sighash.json
   data/tx_invalid.json
   data/tx_valid.json
+  data/val64_conversion.json
+  data/varops_tests.json
 )
 target_raw_data_sources(test_bitcoin NAMESPACE test::data
   data/asmap.raw
diff --git a/src/test/data/gsr_tests.json b/src/test/data/gsr_tests.json
new file mode 100644
index 000000000000..28f7498fcbf3
--- /dev/null
+++ b/src/test/data/gsr_tests.json
@@ -0,0 +1,481 @@
+[
+    {
+        "category": "OP_LEFT and OP_RIGHT tests",
+        "tests": [
+            {
+                "name": "OP_LEFT - basic functionality",
+                "initial stack": ["68656C6C6F", "03"],
+                "opcodes": ["OP_LEFT"],
+                "success": true,
+                "final stack": ["68656C"],
+                "varops cost": 1,
+                "description": "LENGTHCONV: len(OFFSET) = len(0x03) = 1"
+            },
+            {
+                "name": "OP_RIGHT - basic functionality",
+                "initial stack": ["68656C6C6F", "02"],
+                "opcodes": ["OP_RIGHT"],
+                "success": true,
+                "final stack": ["6C6F"],
+                "varops cost": 3,
+                "description": "LENGTHCONV + COPYING: len(OFFSET) + len(result) = 1 + 2 = 3"
+            },
+            {
+                "name": "OP_LEFT with zero offset",
+                "initial stack": ["74657374", ""],
+                "opcodes": ["OP_LEFT"],
+                "success": true,
+                "final stack": [""],
+                "varops cost": 0,
+                "description": "LENGTHCONV: len(OFFSET) = len(empty) = 0"
+            },
+            {
+                "name": "OP_RIGHT with zero offset",
+                "initial stack": ["74657374", ""],
+                "opcodes": ["OP_RIGHT"],
+                "success": true,
+                "final stack": [""],
+                "varops cost": 0,
+                "description": "LENGTHCONV + COPYING: len(OFFSET) + len(result) = 0 + 0 = 0"
+            },
+            {
+                "name": "OP_LEFT with offset equal to string length",
+                "initial stack": ["616263", "03"],
+                "opcodes": ["OP_LEFT"],
+                "success": true,
+                "final stack": ["616263"],
+                "varops cost": 1,
+                "description": "LENGTHCONV: len(OFFSET) = 1"
+            },
+            {
+                "name": "OP_RIGHT with offset equal to string length",
+                "initial stack": ["616263", "03"],
+                "opcodes": ["OP_RIGHT"],
+                "success": true,
+                "final stack": ["616263"],
+                "varops cost": 4,
+                "description": "LENGTHCONV + COPYING: len(OFFSET) + len(result) = 1 + 3 = 4"
+            },
+            {
+                "name": "OP_LEFT with offset greater than string length",
+                "initial stack": ["6869", "0A"],
+                "opcodes": ["OP_LEFT"],
+                "success": true,
+                "final stack": ["6869"],
+                "varops cost": 1,
+                "description": "LENGTHCONV: len(OFFSET) = 1"
+            },
+            {
+                "name": "OP_RIGHT with offset greater than string length",
+                "initial stack": ["6869", "0A"],
+                "opcodes": ["OP_RIGHT"],
+                "success": true,
+                "final stack": ["6869"],
+                "varops cost": 3,
+                "description": "LENGTHCONV + COPYING: len(OFFSET) + len(result) = 1 + 2 = 3"
+            },
+            {
+                "name": "OP_LEFT with binary data",
+                "initial stack": ["0102030405", "03"],
+                "opcodes": ["OP_LEFT"],
+                "success": true,
+                "final stack": ["010203"],
+                "varops cost": 1,
+                "description": "LENGTHCONV: len(OFFSET) = 1"
+            },
+            {
+                "name": "OP_RIGHT with binary data",
+                "initial stack": ["0102030405", "02"],
+                "opcodes": ["OP_RIGHT"],
+                "success": true,
+                "final stack": ["0405"],
+                "varops cost": 3,
+                "description": "LENGTHCONV + COPYING: len(OFFSET) + len(result) = 1 + 2 = 3"
+            },
+            {
+                "name": "OP_LEFT with insufficient stack elements should fail",
+                "initial stack": ["616263"],
+                "opcodes": ["OP_LEFT"],
+                "success": false
+            },
+            {
+                "name": "OP_RIGHT with insufficient stack elements should fail",
+                "initial stack": ["01"],
+                "opcodes": ["OP_RIGHT"],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_CAT tests",
+        "tests": [
+            {
+                "name": "OP_CAT - basic concatenation",
+                "initial stack": ["616263", "646566"],
+                "opcodes": ["OP_CAT"],
+                "success": true,
+                "final stack": ["616263646566"],
+                "varops cost": 6,
+                "description": "COPYING: len(A) + len(B) = 3 + 3 = 6"
+            },
+            {
+                "name": "OP_CAT with empty first operand",
+                "initial stack": ["", "68656C6C6F"],
+                "opcodes": ["OP_CAT"],
+                "success": true,
+                "final stack": ["68656C6C6F"],
+                "varops cost": 5,
+                "description": "COPYING: len(A) + len(B) = 0 + 5 = 5"
+            },
+            {
+                "name": "OP_CAT with empty second operand",
+                "initial stack": ["74657374", ""],
+                "opcodes": ["OP_CAT"],
+                "success": true,
+                "final stack": ["74657374"],
+                "varops cost": 4,
+                "description": "COPYING: len(A) + len(B) = 4 + 0 = 4"
+            },
+            {
+                "name": "OP_CAT with both operands empty",
+                "initial stack": ["", ""],
+                "opcodes": ["OP_CAT"],
+                "success": true,
+                "final stack": [""],
+                "varops cost": 0,
+                "description": "COPYING: len(A) + len(B) = 0 + 0 = 0"
+            },
+            {
+                "name": "OP_CAT with binary data",
+                "initial stack": ["0102", "030405"],
+                "opcodes": ["OP_CAT"],
+                "success": true,
+                "final stack": ["0102030405"],
+                "varops cost": 5,
+                "description": "COPYING: len(A) + len(B) = 2 + 3 = 5"
+            },
+            {
+                "name": "OP_CAT with single byte operands",
+                "initial stack": ["FF", "00"],
+                "opcodes": ["OP_CAT"],
+                "success": true,
+                "final stack": ["FF00"],
+                "varops cost": 2,
+                "description": "COPYING: len(A) + len(B) = 1 + 1 = 2"
+            },
+            {
+                "name": "OP_CAT with insufficient stack elements should fail",
+                "initial stack": ["616263"],
+                "opcodes": ["OP_CAT"],
+                "success": false
+            },
+            {
+                "name": "OP_CAT with empty stack should fail",
+                "initial stack": [],
+                "opcodes": ["OP_CAT"],
+                "success": false
+            },
+            {
+                "name": "OP_CAT exceeding MAX_TAPSCRIPT_V2_STACK_ELEMENT_SIZE should fail",
+                "initial stack": ["AA{2500000}", "BB{2500000}"],
+                "opcodes": ["OP_CAT"],
+                "success": false
+            },
+            {
+                "name": "OP_CAT at the size limit should succeed",
+                "initial stack": ["CC{2000000}", "DD{2000000}"],
+                "opcodes": ["OP_CAT"],
+                "success": true,
+                "final stack": ["CC{2000000}DD{2000000}"],
+                "varops cost": 4000000,
+                "description": "COPYING: len(A) + len(B) = 2000000 + 2000000 = 4000000"
+            }
+        ]
+    },
+    {
+        "category": "OP_SUBSTR tests",
+        "tests": [
+            {
+                "name": "OP_SUBSTR - basic substring extraction",
+                "initial stack": ["68656C6C6F", "01", "03"],
+                "opcodes": ["OP_SUBSTR"],
+                "success": true,
+                "final stack": ["656C6C"],
+                "varops cost": 5,
+                "description": "LENGTHCONV + COPYING: len(BEGIN) + len(LEN) + min(3, 5-1) = 1 + 1 + 3 = 5"
+            },
+            {
+                "name": "OP_SUBSTR - extract from beginning",
+                "initial stack": ["74657374", "", "02"],
+                "opcodes": ["OP_SUBSTR"],
+                "success": true,
+                "final stack": ["7465"],
+                "varops cost": 3,
+                "description": "LENGTHCONV + COPYING: len(BEGIN) + len(LEN) + min(2, 4-0) = 0 + 1 + 2 = 3"
+            },
+            {
+                "name": "OP_SUBSTR - extract to end",
+                "initial stack": ["626974636F696E", "03", "04"],
+                "opcodes": ["OP_SUBSTR"],
+                "success": true,
+                "final stack": ["636F696E"],
+                "varops cost": 6,
+                "description": "LENGTHCONV + COPYING: len(BEGIN) + len(LEN) + min(4, 7-3) = 1 + 1 + 4 = 6"
+            },
+            {
+                "name": "OP_SUBSTR with zero length",
+                "initial stack": ["68656C6C6F", "02", ""],
+                "opcodes": ["OP_SUBSTR"],
+                "success": true,
+                "final stack": [""],
+                "varops cost": 1,
+                "description": "LENGTHCONV + COPYING: len(BEGIN) + len(LEN) + min(0, 5-2) = 1 + 0 + 0 = 1"
+            },
+            {
+                "name": "OP_SUBSTR - begin at end of string",
+                "initial stack": ["616263", "03", "01"],
+                "opcodes": ["OP_SUBSTR"],
+                "success": true,
+                "final stack": [""],
+                "varops cost": 2,
+                "description": "LENGTHCONV + COPYING: len(BEGIN) + len(LEN) + min(1, 3-3) = 1 + 1 + 0 = 2"
+            },
+            {
+                "name": "OP_SUBSTR - begin beyond string length",
+                "initial stack": ["6869", "0A", "05"],
+                "opcodes": ["OP_SUBSTR"],
+                "success": true,
+                "final stack": [""],
+                "varops cost": 2,
+                "description": "LENGTHCONV + COPYING: len(BEGIN) + len(LEN) + min(5, max(0, 2-10)) = 1 + 1 + 0 = 2"
+            },
+            {
+                "name": "OP_SUBSTR - length extends beyond string",
+                "initial stack": ["74657374", "02", "0A"],
+                "opcodes": ["OP_SUBSTR"],
+                "success": true,
+                "final stack": ["7374"],
+                "varops cost": 4,
+                "description": "LENGTHCONV + COPYING: len(BEGIN) + len(LEN) + min(10, 4-2) = 1 + 1 + 2 = 4"
+            },
+            {
+                "name": "OP_SUBSTR with binary data",
+                "initial stack": ["0102030405", "01", "03"],
+                "opcodes": ["OP_SUBSTR"],
+                "success": true,
+                "final stack": ["020304"],
+                "varops cost": 5,
+                "description": "LENGTHCONV + COPYING: len(BEGIN) + len(LEN) + min(3, 5-1) = 1 + 1 + 3 = 5"
+            },
+            {
+                "name": "OP_SUBSTR with empty string",
+                "initial stack": ["", "", "01"],
+                "opcodes": ["OP_SUBSTR"],
+                "success": true,
+                "final stack": [""],
+                "varops cost": 1,
+                "description": "LENGTHCONV + COPYING: len(BEGIN) + len(LEN) + min(1, 0-0) = 0 + 1 + 0 = 1"
+            },
+            {
+                "name": "OP_SUBSTR with insufficient stack elements should fail",
+                "initial stack": ["616263", "01"],
+                "opcodes": ["OP_SUBSTR"],
+                "success": false
+            },
+            {
+                "name": "OP_SUBSTR with empty stack should fail",
+                "initial stack": [],
+                "opcodes": ["OP_SUBSTR"],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_INVERT tests",
+        "tests": [
+            {
+                "name": "OP_INVERT - basic bitwise inversion",
+                "initial stack": ["FF"],
+                "opcodes": ["OP_INVERT"],
+                "success": true,
+                "final stack": ["00"],
+                "varops cost": 2,
+                "description": "OTHER: len(A) * 2 = 1 * 2 = 2"
+            },
+            {
+                "name": "OP_INVERT with all zeros",
+                "initial stack": [""],
+                "opcodes": ["OP_INVERT"],
+                "success": true,
+                "final stack": [""],
+                "varops cost": 0,
+                "description": "OTHER: len(A) * 2 = 0 * 2 = 0"
+            },
+            {
+                "name": "OP_INVERT with multi-byte value",
+                "initial stack": ["FF12"],
+                "opcodes": ["OP_INVERT"],
+                "success": true,
+                "final stack": ["00ED"],
+                "varops cost": 4,
+                "description": "OTHER: len(A) * 2 = 2 * 2 = 4"
+            },
+            {
+                "name": "OP_INVERT with all ones",
+                "initial stack": ["FFFFFFFFFFFFFFFF"],
+                "opcodes": ["OP_INVERT"],
+                "success": true,
+                "final stack": ["0000000000000000"],
+                "varops cost": 16,
+                "description": "OTHER: len(A) * 2 = 8 * 2 = 16"
+            },
+            {
+                "name": "OP_INVERT with alternating bit pattern",
+                "initial stack": ["AAAAAAAAAAAAAAAA"],
+                "opcodes": ["OP_INVERT"],
+                "success": true,
+                "final stack": ["5555555555555555"],
+                "varops cost": 16,
+                "description": "OTHER: len(A) * 2 = 8 * 2 = 16"
+            },
+            {
+                "name": "OP_INVERT with insufficient stack elements should fail",
+                "initial stack": [],
+                "opcodes": ["OP_INVERT"],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "Binary bitwise operations",
+        "tests": [
+            {
+                "name": "OP_AND: 0xFF & 0xF0 = 0xF0",
+                "initial stack": ["FF", "F0"],
+                "opcodes": ["OP_AND"],
+                "success": true,
+                "final stack": ["F0"],
+                "varops cost": 2,
+                "description": "OTHER + ZEROING: len(A) + len(B) = 1 + 1 = 2"
+            },
+            {
+                "name": "OP_OR: 0x0F | 0xF0 = 0xFF",
+                "initial stack": ["0F", "F0"],
+                "opcodes": ["OP_OR"],
+                "success": true,
+                "final stack": ["FF"],
+                "varops cost": 2,
+                "description": "OTHER: min(len(A), len(B)) * 2 = min(1, 1) * 2 = 2"
+            },
+            {
+                "name": "OP_XOR: 0xFF ^ 0x0F = 0xF0",
+                "initial stack": ["FF", "0F"],
+                "opcodes": ["OP_XOR"],
+                "success": true,
+                "final stack": ["F0"],
+                "varops cost": 2,
+                "description": "OTHER: min(len(A), len(B)) * 2 = min(1, 1) * 2 = 2"
+            },
+            {
+                "name": "OP_AND with insufficient stack (empty)",
+                "initial stack": [],
+                "opcodes": ["OP_AND"],
+                "success": false
+            },
+            {
+                "name": "OP_OR with insufficient stack (one element)",
+                "initial stack": ["FF"],
+                "opcodes": ["OP_OR"],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "Stack Manipulation",
+        "tests": [
+            {
+                "name": "OP_ROT: 0x01, 0x02, 0x03, 0x04",
+                "initial stack": ["0x01", "0x02", "0x03", "0x04"],
+                "opcodes": ["OP_ROT"],
+                "success": true,
+                "final stack": ["0x01", "0x03", "0x04", "0x02"],
+                "varops cost": 0,
+                "description": ""
+            },
+            {
+                "name": "OP_SWAP 0x01, 0x02, 0x03",
+                "initial stack": ["0x01", "0x02", "0x03"],
+                "opcodes": ["OP_SWAP"],
+                "success": true,
+                "final stack": ["0x01", "0x03", "0x02"],
+                "varops cost": 0
+            },
+            {
+                "name": "OP_SIZE 0x01, 0x02, 0x03",
+                "initial stack": ["0x01", "0x02", "0x03"],
+                "opcodes": ["OP_SIZE"],
+                "success": true,
+                "final stack": ["0x01", "0x02", "0x03", "0x01"],
+                "varops cost": 1
+            },
+            {
+                "name": "OP_DEPTH 0x01, 0x02, 0x03, 0x04, 0x05",
+                "initial stack": ["0x01", "0x02", "0x03", "0x04", "0x05"],
+                "opcodes": ["OP_DEPTH"],
+                "success": true,
+                "final stack": ["0x01", "0x02", "0x03", "0x04", "0x05", "0x05"],
+                "varops cost": 1
+            },
+            {
+                "name": "OP_IFDUP with zero value",
+                "initial stack": ["0x"],
+                "opcodes": ["OP_IFDUP"],
+                "success": true,
+                "final stack": ["0x"],
+                "varops cost": 0,
+                "description": "IFDUP with zero does not duplicate"
+            },
+            {
+                "name": "OP_IFDUP with non-zero value",
+                "initial stack": ["0x05"],
+                "opcodes": ["OP_IFDUP"],
+                "success": true,
+                "final stack": ["0x05", "0x05"],
+                "varops cost": 2,
+                "description": "IFDUP with non-zero duplicates the value"
+            },
+            {
+                "name": "OP_IFDUP with multi-byte value",
+                "initial stack": ["0x0102"],
+                "opcodes": ["OP_IFDUP"],
+                "success": true,
+                "final stack": ["0x0102", "0x0102"],
+                "varops cost": 4,
+                "description": "IFDUP duplicates multi-byte values"
+            },
+            {
+                "name": "OP_IFDUP on empty stack",
+                "initial stack": [],
+                "opcodes": ["OP_IFDUP"],
+                "success": false,
+                "final stack": [],
+                "varops cost": 0,
+                "description": "IFDUP fails on empty stack"
+            }
+        ]
+    },
+    {
+        "category": "Numeric Operations",
+        "tests": [
+            {
+                "name": "OP_1NEGATE pushes -1",
+                "initial stack": [],
+                "opcodes": ["OP_1NEGATE"],
+                "success": true,
+                "final stack": [],
+                "varops cost": 0,
+                "description": "OP_1NEGATE is OP_SUCCESS in Tapscript v2, does nothing"
+            }
+        ]
+    }
+]
diff --git a/src/test/data/val64_conversion.json b/src/test/data/val64_conversion.json
new file mode 100644
index 000000000000..69e1cb9d954c
--- /dev/null
+++ b/src/test/data/val64_conversion.json
@@ -0,0 +1,29 @@
+[
+    ["Empty test",
+     [], []
+    ],
+    ["Single zero unit (final 0)",
+     [0], [0]
+    ],
+    ["Single unit",
+     [1], [1]
+    ],
+    ["Little endian",
+     [1, 2], [513]
+    ],
+    ["Little endian, redundant zeroes",
+     [1, 2, 0], [513]
+    ],
+    ["Little endian 8 chars",
+     [1, 0, 0, 0, 0, 0, 0, 2], [144115188075855873]
+    ],
+    ["Little endian becomes little-wordian",
+     [1, 0, 0, 0, 0, 0, 0, 2, 7], [144115188075855873, 7]
+    ],
+    ["Don't trim zeroes on conversion to 64",
+     [1, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0], [144115188075855873, 0]
+    ],
+    ["Two full words",
+     [1, 0, 0, 0, 0, 0, 0, 2, 3, 0, 0, 0, 0, 0, 0, 2], [144115188075855873, 144115188075855875]
+    ]
+]
diff --git a/src/test/data/varops_tests.json b/src/test/data/varops_tests.json
new file mode 100644
index 000000000000..5a237efe565d
--- /dev/null
+++ b/src/test/data/varops_tests.json
@@ -0,0 +1,2995 @@
+[
+    {
+        "category": "OP_VERIFY tests",
+        "tests": [
+            {
+                "name": "OP_VERIFY simple success (non-zero)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "69"
+                ],
+                "success": true,
+                "final stack": [],
+                "varops cost": 1,
+                "description": "COMPARINGZERO: len(A) = 1"
+            },
+            {
+                "name": "OP_VERIFY success (non-zero, multiple bytes)",
+                "initial stack": [
+                    "00000001"
+                ],
+                "opcodes": [
+                    "69"
+                ],
+                "success": true,
+                "final stack": [],
+                "varops cost": 4,
+                "description": "COMPARINGZERO: len(A) = 4"
+            },
+            {
+                "name": "OP_VERIFY fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "69"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_VERIFY fail (explicit zero byte)",
+                "initial stack": [
+                    "00"
+                ],
+                "opcodes": [
+                    "69"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_VERIFY fail (multi-zero)",
+                "initial stack": [
+                "00{4000000}"
+                ],
+                "opcodes": [
+                    "69"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_VERIFY success (only last byte non-zero)",
+                "initial stack": [
+                  "00{3999999}01"
+                ],
+                "opcodes": [
+                  "69"
+                ],
+                "success": true,
+                "final stack": [],
+                "varops cost": 4000000,
+                "description": "COMPARINGZERO: len(A) = 4000000"
+              },
+                          {
+                "name": "OP_VERIFY stack presence test (zero followed by 01)",
+                "initial stack": [
+                    "00",
+                    "01"
+                ],
+                "opcodes": [
+                    "69"
+                ],
+                "success": true,
+                "final stack": [
+                    "00"
+                ],
+                "varops cost": 1,
+                "description": "COMPARINGZERO: len(A) = 1"
+            }
+        ]
+    },
+    {
+        "category": "OP_NOT tests",
+        "tests": [
+            {
+                "name": "OP_NOT success (non-zero becomes empty string)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "91"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 1,
+                "description": "COMPARINGZERO: len(A) = 1"
+            },
+            {
+                "name": "OP_NOT success (multi-byte non-zero becomes empty string)",
+                "initial stack": [
+                    "00000001"
+                ],
+                "opcodes": [
+                    "91"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 4,
+                "description": "COMPARINGZERO: len(A) = 4"
+            },
+            {
+                "name": "OP_NOT fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "91"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_NOT success (single zero byte)",
+                "initial stack": [
+                    "00"
+                ],
+                "opcodes": [
+                    "91"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1,
+                "description": "COMPARINGZERO: len(A) = 1"
+            },
+            {
+                "name": "OP_NOT success (multi-byte all zero)",
+                "initial stack": [
+                "00{4000000}"
+                ],
+                "opcodes": [
+                "91"
+                ],
+                "success": true,
+                "final stack": [
+                "01"
+                ],
+                "varops cost": 4000000,
+                "description": "COMPARINGZERO: len(A) = 4000000"
+            },
+            {
+                "name": "OP_NOT success (explicit empty string)",
+                "initial stack": [
+                    ""
+                ],
+                "opcodes": [
+                    "91"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 0,
+                "description": "COMPARINGZERO: len(A) = 0"
+            },
+            {
+                "name": "OP_NOT success (only last byte non-zero)",
+                "initial stack": [
+                  "00{3999999}01"
+                ],
+                "opcodes": [
+                  "91"
+                ],
+                "success": true,
+                "final stack": [
+                  ""
+                ],
+                "varops cost": 4000000,
+                "description": "COMPARINGZERO: len(A) = 4000000"
+              }
+        ]
+    },
+    {
+        "category": "OP_0NOTEQUAL tests",
+        "tests": [
+            {
+                "name": "OP_0NOTEQUAL success (non-zero becomes 01)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "92"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1,
+                "description": "COMPARINGZERO: len(A) = 1"
+            },
+            {
+                "name": "OP_0NOTEQUAL success (multi-byte non-zero becomes 01)",
+                "initial stack": [
+                    "00000001"
+                ],
+                "opcodes": [
+                    "92"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 4,
+                "description": "COMPARINGZERO: len(A) = 4"
+            },
+            {
+                "name": "OP_0NOTEQUAL fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "92"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_0NOTEQUAL success (single zero becomes empty)",
+                "initial stack": [
+                    "00"
+                ],
+                "opcodes": [
+                    "92"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 1,
+                "description": "COMPARINGZERO: len(A) = 1"
+            },
+            {
+                "name": "OP_0NOTEQUAL success (explicit empty string becomes empty)",
+                "initial stack": [
+                  ""
+                ],
+                "opcodes": [
+                  "92"
+                ],
+                "success": true,
+                "final stack": [
+                  ""
+                ],
+                "varops cost": 0,
+                "description": "COMPARINGZERO: len(A) = 0"
+              },
+              {
+                "name": "OP_0NOTEQUAL success (multi-byte zero becomes empty)",
+                "initial stack": [
+                  "00{4000000}"
+                ],
+                "opcodes": [
+                  "92"
+                ],
+                "success": true,
+                "final stack": [
+                  ""
+                ],
+                "varops cost": 4000000,
+                "description": "COMPARINGZERO: len(A) = 4000000"
+              },
+              {
+                "name": "OP_0NOTEQUAL success (only last byte non-zero becomes 01)",
+                "initial stack": [
+                  "00{3999999}01"
+                ],
+                "opcodes": [
+                  "92"
+                ],
+                "success": true,
+                "final stack": [
+                  "01"
+                ],
+                "varops cost": 4000000,
+                "description": "COMPARINGZERO: len(A) = 4000000"
+              }
+        ]
+    },
+    {
+        "category": "OP_EQUAL tests",
+        "tests": [
+            {
+                "name": "OP_EQUAL success (equal non-empty strings)",
+                "initial stack": [
+                    "abcd",
+                    "abcd"
+                ],
+                "opcodes": [
+                    "87"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 2,
+                "description": "COMPARING: len(A) = 2 (same length, so compare)"
+            },
+            {
+                "name": "OP_EQUAL success (equal empty strings)",
+                "initial stack": [
+                    "",
+                    ""
+                ],
+                "opcodes": [
+                    "87"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 0,
+                "description": "COMPARING: len(A) = 0 (both empty)"
+            },
+            {
+                "name": "OP_EQUAL fail (non-equal same length)",
+                "initial stack": [
+                    "abcd",
+                    "abce"
+                ],
+                "opcodes": [
+                    "87"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 2,
+                "description": "COMPARING: len(A) = 2 (same length, so compare)"
+            },
+            {
+                "name": "OP_EQUAL fail (different lengths)",
+                "initial stack": [
+                    "abcd",
+                    "ab"
+                ],
+                "opcodes": [
+                    "87"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 0,
+                "description": "COMPARING: 0 (different lengths, no comparison needed)"
+            },
+            {
+                "name": "OP_EQUAL fail (prefix match only)",
+                "initial stack": [
+                  "01",
+                  "01{3999999}"
+                ],
+                "opcodes": [
+                  "87"
+                ],
+                "success": true,
+                "final stack": [
+                  ""
+                ],
+                "varops cost": 0,
+                "description": "COMPARING: 0 (different lengths, no comparison needed)"
+            },
+            {
+                "name": "OP_EQUAL fail (only one operand)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "87"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_EQUAL fail (zero operands)",
+                "initial stack": [],
+                "opcodes": [
+                    "87"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_EQUALVERIFY tests",
+        "tests": [
+            {
+                "name": "OP_EQUALVERIFY success (equal non-empty strings)",
+                "initial stack": [
+                    "abcd",
+                    "abcd"
+                ],
+                "opcodes": [
+                    "88"
+                ],
+                "success": true,
+                "final stack": [],
+                "varops cost": 2,
+                "description": "COMPARING: len(A) = 2 (same length, so compare)"
+            },
+            {
+                "name": "OP_EQUALVERIFY success (equal empty strings)",
+                "initial stack": [
+                    "",
+                    ""
+                ],
+                "opcodes": [
+                    "88"
+                ],
+                "success": true,
+                "final stack": [],
+                "varops cost": 0,
+                "description": "COMPARING: len(A) = 0 (both empty)"
+            },
+            {
+                "name": "OP_EQUALVERIFY fail (non-equal same length)",
+                "initial stack": [
+                    "abcd",
+                    "abce"
+                ],
+                "opcodes": [
+                    "88"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_EQUALVERIFY fail (different lengths)",
+                "initial stack": [
+                    "abcd",
+                    "ab"
+                ],
+                "opcodes": [
+                    "88"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_EQUALVERIFY fail (prefix match only)",
+                "initial stack": [
+                  "01",
+                  "01{3999999}"
+                ],
+                "opcodes": [
+                  "88"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_EQUALVERIFY fail (only one operand)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "88"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_EQUALVERIFY fail (zero operands)",
+                "initial stack": [],
+                "opcodes": [
+                    "88"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_2DUP tests",
+        "tests": [
+            {
+                "name": "OP_2DUP success (two small items)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "6e"
+                ],
+                "success": true,
+                "final stack": [
+                    "01",
+                    "02",
+                    "01",
+                    "02"
+                ],
+                "varops cost": 2,
+                "description": "COPYING: len(A) + len(B) = 1 + 1 = 2"
+            },
+            {
+                "name": "OP_2DUP fail (only one item)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "6e"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_2DUP fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "6e"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_2DUP success (stack total size exactly 8000000)",
+                "initial stack": [
+                  "aa",
+                  "ff{3999999}"
+                ],
+                "opcodes": [
+                  "6e"
+                ],
+                "success": true,
+                "final stack": [
+                  "aa",
+                  "ff{3999999}",
+                  "aa",
+                  "ff{3999999}"
+                ],
+                "varops cost": 4000000,
+                "description": "COPYING: len(A) + len(B) = 1 + 3999999 = 4000000"
+              },
+              {
+                "name": "OP_2DUP fail (stack total size equals 8000001)",
+                "initial stack": [
+                  "ffffff",
+                  "ff{2000000}",
+                  "ff{1999999}"
+                ],
+                "opcodes": [
+                  "6e"
+                ],
+                "success": false
+              },
+              {
+                "name": "OP_2DUP success (stack total size exactly 8000000 including altstack)",
+                "initial stack": [
+                  "aa",
+                  "ff{3999998}",
+                  "bbcc"
+                ],
+                "opcodes": [
+                  "6b",
+                  "6e"
+                ],
+                "success": true,
+                "final stack": [
+                  "aa",
+                  "ff{3999998}",
+                  "aa",
+                  "ff{3999998}"
+                ],
+                "final altstack": [
+                  "bbcc"
+                ],
+                "varops cost": 3999999,
+                "description": "COPYING: OP_2DUP (len(A) + len(B) = 1 + 3999998) = 3999999"
+              },
+              {
+                "name": "OP_2DUP fail (stack total size including altstack equals 8000001)",
+                "initial stack": [
+                  "ff{2000000}",
+                  "ff{1999999}",
+                  "ffffff"
+                ],
+                "opcodes": [
+                  "6b",
+                  "6e"
+                ],
+                "success": false
+              }
+        ]
+    },
+    {
+        "category": "OP_DUP3 tests",
+        "tests": [
+            {
+                "name": "OP_DUP3 success (three small items)",
+                "initial stack": [
+                    "01",
+                    "02",
+                    "03"
+                ],
+                "opcodes": [
+                    "6f"
+                ],
+                "success": true,
+                "final stack": [
+                    "01",
+                    "02",
+                    "03",
+                    "01",
+                    "02",
+                    "03"
+                ],
+                "varops cost": 3,
+                "description": "COPYING: len(A) + len(B) + len(C) = 1 + 1 + 1 = 3"
+            },
+            {
+                "name": "OP_DUP3 fail (only two items)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "6f"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_DUP3 fail (only one item)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "6f"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_DUP3 fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "6f"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_DUP3 success (stack total size exactly 8000000)",
+                "initial stack": [
+                  "aa",
+                  "bb",
+                  "ff{3999998}"
+                ],
+                "opcodes": [
+                  "6f"
+                ],
+                "success": true,
+                "final stack": [
+                  "aa",
+                  "bb",
+                  "ff{3999998}",
+                  "aa",
+                  "bb",
+                  "ff{3999998}"
+                ],
+                "varops cost": 4000000,
+                "description": "COPYING: len(A) + len(B) + len(C) = 1 + 1 + 3999998 = 4000000"
+              },
+              {
+                "name": "OP_DUP3 fail (stack total size equals 8000001)",
+                "initial stack": [
+                  "ffffff",
+                  "ff{2000000}",
+                  "ff{1999999}"
+                ],
+                "opcodes": [
+                  "6f"
+                ],
+                "success": false
+              },
+              {
+                "name": "OP_DUP3 success (stack total size exactly 8000000 including altstack)",
+                "initial stack": [
+                  "aa",
+                  "bb",
+                  "ff{3999995}",
+                  "ccdd"
+                ],
+                "opcodes": [
+                  "6b",
+                  "6f"
+                ],
+                "success": true,
+                "final stack": [
+                  "aa",
+                  "bb",
+                  "ff{3999995}",
+                  "aa",
+                  "bb",
+                  "ff{3999995}"
+                ],
+                "final altstack": [
+                  "ccdd"
+                ],
+                "varops cost": 3999997,
+                "description": "COPYING: OP_3DUP (1 + 1 + 3999995) = 3999997"
+              },
+              {
+                "name": "OP_DUP3 fail (stack+altstack total size = 8000001)",
+                "initial stack": [
+                  "ff{2000000}",
+                  "ff{1999999}",
+                  "ffffff",
+                  "aabbcc"
+                ],
+                "opcodes": [
+                  "6b",
+                  "6f"
+                ],
+                "success": false
+              }
+        ]
+    },
+    {
+        "category": "OP_2OVER tests",
+        "tests": [
+            {
+                "name": "OP_2OVER success (four small items)",
+                "initial stack": [
+                    "a1",
+                    "b2",
+                    "c3",
+                    "d4"
+                ],
+                "opcodes": [
+                    "70"
+                ],
+                "success": true,
+                "final stack": [
+                    "a1",
+                    "b2",
+                    "c3",
+                    "d4",
+                    "a1",
+                    "b2"
+                ],
+                "varops cost": 2,
+                "description": "COPYING: len(C) + len(D) = 1 + 1 = 2"
+            },
+            {
+                "name": "OP_2OVER fail (three items)",
+                "initial stack": [
+                    "a1",
+                    "b2",
+                    "c3"
+                ],
+                "opcodes": [
+                    "70"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_2OVER fail (two items)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "70"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_2OVER fail (only one item)",
+                "initial stack": [
+                    "ff"
+                ],
+                "opcodes": [
+                    "70"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_2OVER fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "70"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_2OVER success (stack total size exactly 8000000)",
+                "initial stack": [
+                  "aa",
+                  "bb",
+                  "ff{3999998}",
+                  "00"
+                ],
+                "opcodes": [
+                  "70"
+                ],
+                "success": true,
+                "final stack": [
+                  "aa",
+                  "bb",
+                  "ff{3999998}",
+                  "00",
+                  "aa",
+                  "bb"
+                ],
+                "varops cost": 2,
+                "description": "COPYING: len(C) + len(D) = 1 + 1 = 2"
+              },
+              {
+                "name": "OP_2OVER fail (stack total size exceeds 8000000)",
+                "initial stack": [
+                  "01",
+                  "02",
+                  "ff{4000000}",
+                  "ff{3999999}"
+                ],
+                "opcodes": [
+                  "70"
+                ],
+                "success": false
+              },
+              {
+                "name": "OP_2OVER fail (stack+altstack exceeds 8000000)",
+                "initial stack": [
+                  "ff{1999999}",
+                  "ff{1999999}",
+                  "ff{1999999}",
+                  "ff{1999999}",
+                  "deadbeef"
+                ],
+                "opcodes": [
+                  "6b",
+                  "70"
+                ],
+                "success": false
+              },
+              {
+                "name": "OP_2OVER success (stack+altstack exactly 8000000)",
+                "initial stack": [
+                  "aa",
+                  "bb",
+                  "ff{3999997}",
+                  "cc",
+                  "dd"
+                ],
+                "opcodes": [
+                  "6b",
+                  "70"
+                ],
+                "success": true,
+                "final stack": [
+                  "aa",
+                  "bb",
+                  "ff{3999997}",
+                  "cc",
+                  "aa",
+                  "bb"
+                ],
+                "final altstack": [
+                  "dd"
+                ],
+                "varops cost": 2,
+                "description": "COPYING: OP_2OVER (1 + 1) = 2"
+              }
+        ]
+    },
+    {
+        "category": "OP_IFDUP tests",
+        "tests": [
+            {
+                "name": "OP_IFDUP success (non-zero one-byte)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "73"
+                ],
+                "success": true,
+                "final stack": [
+                    "01",
+                    "01"
+                ],
+                "varops cost": 2,
+                "description": "COMPARINGZERO + COPYING: len(A) * 2 = 1 * 2 = 2"
+            },
+            {
+                "name": "OP_IFDUP success (non-zero multi-byte)",
+                "initial stack": [
+                    "0001"
+                ],
+                "opcodes": [
+                    "73"
+                ],
+                "success": true,
+                "final stack": [
+                    "0001",
+                    "0001"
+                ],
+                "varops cost": 4,
+                "description": "COMPARINGZERO + COPYING: len(A) * 2 = 2 * 2 = 4"
+            },
+            {
+                "name": "OP_IFDUP success (empty string is zero)",
+                "initial stack": [
+                    ""
+                ],
+                "opcodes": [
+                    "73"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 0,
+                "description": "COMPARINGZERO: len(A) = 0 (no check needed for empty)"
+            },
+            {
+                "name": "OP_IFDUP success (all-zero multi-byte is zero)",
+                "initial stack": [
+                  "00{4000000}"
+                ],
+                "opcodes": [
+                  "73"
+                ],
+                "success": true,
+                "final stack": [
+                  "00{4000000}"
+                ],
+                "varops cost": 8000000,
+                "description": "COMPARINGZERO + COPYING: len(A) * 2 = 4000000 * 2 = 8000000"
+              },
+              {
+                "name": "OP_IFDUP success (last byte non-zero triggers duplication)",
+                "initial stack": [
+                  "00{3999999}01"
+                ],
+                "opcodes": [
+                  "73"
+                ],
+                "success": true,
+                "final stack": [
+                  "00{3999999}01",
+                  "00{3999999}01"
+                ],
+                "varops cost": 8000000,
+                "description": "COMPARINGZERO + COPYING: len(A) * 2 = 4000000 * 2 = 8000000"
+            },
+            {
+                "name": "OP_IFDUP fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "73"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_IFDUP success (duplication puts stack+altstack exactly at 8000000)",
+                "initial stack": [
+                    "aa",
+                    "ff{3999998}"
+                ],
+                "opcodes": [
+                  "6b",
+                  "73"
+                ],
+                "success": true,
+                "final stack": [
+                  "aa",
+                  "aa"
+                ],
+                "final altstack": [
+                  "ff{3999998}"
+                ],
+                "varops cost": 2,
+                "description": "COPYING: OP_IFDUP (len=1 check) = 1 * 2 = 2"
+              },
+              {
+                "name": "OP_IFDUP fail (duplication causes stack+altstack > 8000000)",
+                "initial stack": [
+                  "ff{4000000}",
+                  "ab"
+                ],
+                "opcodes": [
+                  "6b",
+                  "73"
+                ],
+                "success": false
+              }
+        ]
+    },
+    {
+        "category": "OP_DUP tests",
+        "tests": [
+            {
+                "name": "OP_DUP success (one-byte item)",
+                "initial stack": [
+                    "ff"
+                ],
+                "opcodes": [
+                    "76"
+                ],
+                "success": true,
+                "final stack": [
+                    "ff",
+                    "ff"
+                ],
+                "varops cost": 1,
+                "description": "COPYING: len(A) = 1"
+            },
+            {
+                "name": "OP_DUP success (multi-byte item)",
+                "initial stack": [
+                    "abcd"
+                ],
+                "opcodes": [
+                    "76"
+                ],
+                "success": true,
+                "final stack": [
+                    "abcd",
+                    "abcd"
+                ],
+                "varops cost": 2,
+                "description": "COPYING: len(A) = 2"
+            },
+            {
+                "name": "OP_DUP success (empty string)",
+                "initial stack": [
+                    ""
+                ],
+                "opcodes": [
+                    "76"
+                ],
+                "success": true,
+                "final stack": [
+                    "",
+                    ""
+                ],
+                "varops cost": 0,
+                "description": "COPYING: len(A) = 0"
+            },
+            {
+                "name": "OP_DUP fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "76"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_DUP success (stack+altstack exactly 8000000 after dup)",
+                "initial stack": [
+                  "aa",
+                  "ff{3999998}"
+                ],
+                "opcodes": [
+                  "6b",
+                  "76"
+                ],
+                "success": true,
+                "final stack": [
+                  "aa",
+                  "aa"
+                ],
+                "final altstack": [
+                  "ff{3999998}"
+                ],
+                "varops cost": 1
+
+              },
+              {
+                "name": "OP_DUP fail (stack+altstack > 8000000 after dup)",
+                "initial stack": [
+                  "ff{4000000}",
+                  "ab"
+                ],
+                "opcodes": [
+                  "6b",
+                  "76"
+                ],
+                "success": false
+              }
+        ]
+    },
+    {
+        "category": "OP_OVER tests",
+        "tests": [
+            {
+                "name": "OP_OVER success (two small items)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "78"
+                ],
+                "success": true,
+                "final stack": [
+                    "01",
+                    "02",
+                    "01"
+                ],
+                "varops cost": 1,
+                "description": "COPYING: len(B) = 1"
+            },
+            {
+                "name": "OP_OVER success (multi-byte item copied)",
+                "initial stack": [
+                    "abcd",
+                    "ef"
+                ],
+                "opcodes": [
+                    "78"
+                ],
+                "success": true,
+                "final stack": [
+                    "abcd",
+                    "ef",
+                    "abcd"
+                ],
+                "varops cost": 2,
+                "description": "COPYING: len(B) = 2"
+            },
+            {
+                "name": "OP_OVER success (empty string copied)",
+                "initial stack": [
+                    "",
+                    "ff"
+                ],
+                "opcodes": [
+                    "78"
+                ],
+                "success": true,
+                "final stack": [
+                    "",
+                    "ff",
+                    ""
+                ],
+                "varops cost": 0,
+                "description": "COPYING: len(B) = 0"
+            },
+            {
+                "name": "OP_OVER fail (only one item)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "78"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_OVER fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "78"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_OVER success (stack+altstack exactly 8000000)",
+                "initial stack": [
+                    "aa",
+                    "bb",
+                    "ff{3999998}"
+                ],
+                  "opcodes": [
+                  "6b",
+                  "78"
+                ],
+                "success": true,
+                "final stack": [
+                  "aa",
+                  "bb",
+                  "aa"
+                ],
+                "final altstack": [
+                  "ff{3999998}"
+                ],
+                "varops cost": 1,
+                "description": "COPYING: OP_OVER (len=1) = 1"
+              },
+              {
+                "name": "OP_OVER fail (stack+altstack > 8000000)",
+                "initial stack": [
+                  "ff{4000000}",
+                  "a1"
+                ],
+                "opcodes": [
+                  "6b",
+                  "78"
+                ],
+                "success": false
+              }
+        ]
+    },
+    {
+        "category": "OP_TUCK tests",
+        "tests": [
+            {
+                "name": "OP_TUCK success (two small items)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "7d"
+                ],
+                "success": true,
+                "final stack": [
+                    "02",
+                    "01",
+                    "02"
+                ],
+                "varops cost": 1,
+                "description": "COPYING: len(A) = 1"
+            },
+            {
+                "name": "OP_TUCK success (multi-byte duplication)",
+                "initial stack": [
+                    "a1",
+                    "abcd"
+                ],
+                "opcodes": [
+                    "7d"
+                ],
+                "success": true,
+                "final stack": [
+                    "abcd",
+                    "a1",
+                    "abcd"
+                ],
+                "varops cost": 2,
+                "description": "COPYING: len(A) = 2"
+            },
+            {
+                "name": "OP_TUCK success (empty string duplicated)",
+                "initial stack": [
+                    "a1",
+                    ""
+                ],
+                "opcodes": [
+                    "7d"
+                ],
+                "success": true,
+                "final stack": [
+                    "",
+                    "a1",
+                    ""
+                ],
+                "varops cost": 0,
+                "description": "COPYING: len(A) = 0"
+            },
+            {
+                "name": "OP_TUCK fail (only one item)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "7d"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_TUCK fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "7d"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_TUCK success (stack+altstack exactly 8000000)",
+                "initial stack": [
+                  "aa",
+                  "ff{3999999}",
+                  "bb"
+                ],
+                "opcodes": [
+                  "6b",
+                  "7d"
+                ],
+                "success": true,
+                "final stack": [
+                  "ff{3999999}",
+                  "aa",
+                  "ff{3999999}"
+                ],
+                "final altstack": [
+                  "bb"
+                ],
+                "varops cost": 3999999,
+                "description": "COPYING: OP_TUCK (len=3999999) = 3999999"
+              },
+              {
+                "name": "OP_TUCK fail (stack+altstack > 8000000)",
+                "initial stack": [
+                  "aa",
+                  "ff{3999999}",
+                  "bbbb"
+                ],
+                "opcodes": [
+                  "6b",
+                  "7d"
+                ],
+                "success": false
+              }
+        ]
+    },
+    {
+        "category": "OP_PICK tests",
+        "tests": [
+            {
+                "name": "OP_PICK success (pick index 0 = top)",
+                "initial stack": [
+                    "aa",
+                    ""
+                ],
+                "opcodes": [
+                    "79"
+                ],
+                "success": true,
+                "final stack": [
+                    "aa",
+                    "aa"
+                ],
+                "varops cost": 1,
+                "description": "LENGTHCONV + COPYING: len(A) + len(picked) = 0 + 1 = 1"
+            },
+            {
+                "name": "OP_PICK success (pick index 1 = second)",
+                "initial stack": [
+                    "aa",
+                    "bb",
+                    "01"
+                ],
+                "opcodes": [
+                    "79"
+                ],
+                "success": true,
+                "final stack": [
+                    "aa",
+                    "bb",
+                    "aa"
+                ],
+                "varops cost": 2,
+                "description": "LENGTHCONV + COPYING: len(A) + len(picked) = 1 + 1 = 2"
+            },
+            {
+                "name": "OP_PICK success (multi-byte target and index)",
+                "initial stack": [
+                  "ff{100}",
+                  "ee",
+                  "0100"
+                ],
+                "opcodes": [
+                  "79"
+                ],
+                "success": true,
+                "final stack": [
+                  "ff{100}",
+                  "ee",
+                  "ff{100}"
+                ],
+                "varops cost": 102,
+                "description": "LENGTHCONV + COPYING: len(A) + len(picked) = 2 + 100 = 102"
+            },
+            {
+                "name": "OP_PICK success (zero-length target)",
+                "initial stack": [
+                    "",
+                    ""
+                ],
+                "opcodes": [
+                    "79"
+                ],
+                "success": true,
+                "final stack": [
+                    "",
+                    ""
+                ],
+                "varops cost": 0,
+                "description": "LENGTHCONV + COPYING: len(A) + len(picked) = 0 + 0 = 0"
+            },
+            {
+                "name": "OP_PICK fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "79"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_PICK fail (stack underflow for index 1)",
+                "initial stack": [
+                    "aa",
+                    "01"
+                ],
+                "opcodes": [
+                    "79"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_PICK fail (index 3 out of bounds)",
+                "initial stack": [
+                    "a1",
+                    "b2",
+                    "c3",
+                    "03"
+                ],
+                "opcodes": [
+                    "79"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_PICK success (non-minimal encoding of 0)",
+                "initial stack": [
+                    "aa",
+                    "0000"
+                ],
+                "opcodes": [
+                    "79"
+                ],
+                "success": true,
+                "final stack": [
+                    "aa",
+                    "aa"
+                ],
+                "varops cost": 3,
+                "description": "LENGTHCONV + COPYING: len(A) + len(picked) = 2 + 1 = 3"
+            },
+            {
+                "name": "OP_PICK success (0xff treated as large index, fails as out-of-bounds)",
+                "initial stack": [
+                    "aa",
+                    "ff"
+                ],
+                "opcodes": [
+                    "79"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_PICK success (stack+altstack exactly 8000000)",
+                "initial stack": [
+                    "aa",
+                    "eeee",
+                    "01",
+                    "ff{3999999}"
+                ],
+                "opcodes": [
+                  "6b",
+                  "79"
+                ],
+                "success": true,
+                "final stack": [
+                  "aa",
+                  "eeee",
+                  "aa"
+                ],
+                "final altstack": [
+                  "ff{3999999}"
+                ],
+                "varops cost": 2,
+                "description": "COPYING: OP_PICK (len(A) + len(picked) = 1 + 1) = 2"
+              },
+              {
+                "name": "OP_PICK fail (stack+altstack > 8000000)",
+                "initial stack": [
+                  "ff{4000000}",
+                  "",
+                  "ab"
+                ],
+                "opcodes": [
+                  "6b",
+                  "79"
+                ],
+                "success": false
+              }
+        ]
+    },
+    {
+        "category": "OP_ROLL tests",
+        "tests": [
+            {
+                "name": "OP_ROLL success (roll 0 = no change)",
+                "initial stack": [
+                    "aa",
+                    ""
+                ],
+                "opcodes": [
+                    "7a"
+                ],
+                "success": true,
+                "final stack": [
+                    "aa"
+                ],
+                "varops cost": 0,
+                "description": "LENGTHCONV + ROLL: len(A) + 24 * val(A) = 0 + 24 * 0 = 0"
+            },
+            {
+                "name": "OP_ROLL success (roll 1 = swap)",
+                "initial stack": [
+                    "aa",
+                    "bb",
+                    "01"
+                ],
+                "opcodes": [
+                    "7a"
+                ],
+                "success": true,
+                "final stack": [
+                    "bb",
+                    "aa"
+                ],
+                "varops cost": 25,
+                "description": "LENGTHCONV + ROLL: len(A) + 24 * val(A) = 1 + 24 * 1 = 25"
+            },
+            {
+                "name": "OP_ROLL success (roll from position 2)",
+                "initial stack": [
+                    "a1",
+                    "b2",
+                    "c3",
+                    "02"
+                ],
+                "opcodes": [
+                    "7a"
+                ],
+                "success": true,
+                "final stack": [
+                    "b2",
+                    "c3",
+                    "a1"
+                ],
+                "varops cost": 49,
+                "description": "LENGTHCONV + ROLL: len(A) + 24 * val(A) = 1 + 24 * 2 = 49"
+            },
+            {
+                "name": "OP_ROLL success (non-minimally encoded 0)",
+                "initial stack": [
+                    "aa",
+                    "0000"
+                ],
+                "opcodes": [
+                    "7a"
+                ],
+                "success": true,
+                "final stack": [
+                    "aa"
+                ],
+                "varops cost": 2,
+                "description": "LENGTHCONV + ROLL: len(A) + 24 * val(A) = 2 + 24 * 0 = 2"
+            },
+            {
+                "name": "OP_ROLL fail (index out of bounds)",
+                "initial stack": [
+                    "a1",
+                    "01"
+                ],
+                "opcodes": [
+                    "7a"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_ROLL fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "7a"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_ROLL fail (only one item)",
+                "initial stack": [
+                    ""
+                ],
+                "opcodes": [
+                    "7a"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_ROLL fail (ff interpreted as large index)",
+                "initial stack": [
+                    "aa",
+                    "ff"
+                ],
+                "opcodes": [
+                    "7a"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_BOOLAND tests",
+        "tests": [
+            {
+                "name": "OP_BOOLAND success (both one-byte non-zero)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "9a"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 2,
+                "description": "COMPARINGZERO: len(A) + len(B) = 1 + 1 = 2"
+            },
+            {
+                "name": "OP_BOOLAND success (multi-byte non-zero + single byte)",
+                "initial stack": [
+                    "00000001",
+                    "01"
+                ],
+                "opcodes": [
+                    "9a"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 5,
+                "description": "COMPARINGZERO: len(A) + len(B) = 4 + 1 = 5"
+            },
+            {
+                "name": "OP_BOOLAND success (first zero)",
+                "initial stack": [
+                    "00",
+                    "01"
+                ],
+                "opcodes": [
+                    "9a"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 2,
+                "description": "COMPARINGZERO: len(A) + len(B) = 1 + 1 = 2"
+            },
+            {
+                "name": "OP_BOOLAND success (second zero)",
+                "initial stack": [
+                    "01",
+                    "00"
+                ],
+                "opcodes": [
+                    "9a"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 2,
+                "description": "COMPARINGZERO: len(A) + len(B) = 1 + 1 = 2"
+            },
+            {
+                "name": "OP_BOOLAND success (both empty)",
+                "initial stack": [
+                    "",
+                    ""
+                ],
+                "opcodes": [
+                    "9a"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 0,
+                "description": "COMPARINGZERO: len(A) + len(B) = 0 + 0 = 0"
+            },
+            {
+                "name": "OP_BOOLAND success (both multi-byte zero) FIXME (why is this true?)",
+                "initial stack": [
+                  "00{4000000}",
+                  "00{4000000}"
+                ],
+                "opcodes": [
+                  "9a"
+                ],
+                "success": true,
+                "final stack": [
+                  ""
+                ],
+                "varops cost": 8000000,
+                "description": "COMPARINGZERO: len(A) + len(B) = 4000000 + 4000000 = 8000000"
+              },
+              {
+                "name": "OP_BOOLAND success (one non-zero at the end)",
+                "initial stack": [
+                  "00{3999999}01",
+                  "00{3999999}01"
+                ],
+                "opcodes": [
+                  "9a"
+                ],
+                "success": true,
+                "final stack": [
+                  "01"
+                ],
+                "varops cost": 8000000,
+                "description": "COMPARINGZERO: len(A) + len(B) = 4000000 + 4000000 = 8000000"
+            },
+            {
+                "name": "OP_BOOLAND fail (only one item)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "9a"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_BOOLAND fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "9a"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_BOOLOR tests",
+        "tests": [
+            {
+                "name": "OP_BOOLOR success (both one-byte non-zero)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "9b"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 2,
+                "description": "COMPARINGZERO: len(A) + len(B) = 1 + 1 = 2"
+            },
+            {
+                "name": "OP_BOOLOR success (one zero, one non-zero)",
+                "initial stack": [
+                    "00",
+                    "01"
+                ],
+                "opcodes": [
+                    "9b"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 2,
+                "description": "COMPARINGZERO: len(A) + len(B) = 1 + 1 = 2"
+            },
+            {
+                "name": "OP_BOOLOR success (one empty, one non-zero)",
+                "initial stack": [
+                    "",
+                    "01"
+                ],
+                "opcodes": [
+                    "9b"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1,
+                "description": "COMPARINGZERO: len(A) + len(B) = 0 + 1 = 1"
+            },
+            {
+                "name": "OP_BOOLOR success (both empty)",
+                "initial stack": [
+                    "",
+                    ""
+                ],
+                "opcodes": [
+                    "9b"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 0,
+                "description": "COMPARINGZERO: len(A) + len(B) = 0 + 0 = 0"
+            },
+            {
+                "name": "OP_BOOLOR success (both multi-byte zero) FIXME (why is this true?)",
+                "initial stack": [
+                  "00{4000000}",
+                  "00{4000000}"
+                ],
+                "opcodes": [
+                  "9b"
+                ],
+                "success": true,
+                "final stack": [
+                  ""
+                ],
+                "varops cost": 8000000,
+                "description": "COMPARINGZERO: len(A) + len(B) = 4000000 + 4000000 = 8000000"
+              },
+              {
+                "name": "OP_BOOLOR success (one long non-zero)",
+                "initial stack": [
+                  "00{3999999}01",
+                  "00{4000000}"
+                ],
+                "opcodes": [
+                  "9b"
+                ],
+                "success": true,
+                "final stack": [
+                  "01"
+                ],
+                "varops cost": 8000000,
+                "description": "COMPARINGZERO: len(A) + len(B) = 4000000 + 4000000 = 8000000"
+            },
+            {
+                "name": "OP_BOOLOR fail (only one item)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "9b"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_BOOLOR fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "9b"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_NUMEQUAL tests",
+        "tests": [
+            {
+                "name": "OP_NUMEQUAL success (equal one-byte numbers)",
+                "initial stack": [
+                    "01",
+                    "01"
+                ],
+                "opcodes": [
+                    "9c"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 1) = 1"
+            },
+            {
+                "name": "OP_NUMEQUAL success (equal numbers, padded)",
+                "initial stack": [
+                    "01",
+                    "010000"
+                ],
+                "opcodes": [
+                    "9c"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 3,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 3) = 3"
+            },
+            {
+                "name": "OP_NUMEQUAL success (both zero)",
+                "initial stack": [
+                    "00",
+                    ""
+                ],
+                "opcodes": [
+                    "9c"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 0) = 1"
+            },
+            {
+                "name": "OP_NUMEQUAL fail (different values)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "9c"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 1,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 1) = 1"
+            },
+            {
+                "name": "OP_NUMEQUAL success (equal long values with trailing zeros)",
+                "initial stack": [
+                  "ff{3999999}01",
+                  "ff{3999999}01"
+                ],
+                "opcodes": [
+                  "9c"
+                ],
+                "success": true,
+                "final stack": [
+                  "01"
+                ],
+                "varops cost": 4000000,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(4000000, 4000000) = 4000000"
+            },
+            {
+                "name": "OP_NUMEQUAL success (equal after trimming trailing zeros)",
+                "initial stack": [
+                    "01",
+                    "01000000"
+                ],
+                "opcodes": [
+                    "9c"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 4,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 4) = 4"
+            },
+            {
+                "name": "OP_NUMEQUAL fail (different lengths, same prefix)",
+                "initial stack": [
+                    "01",
+                    "0101"
+                ],
+                "opcodes": [
+                    "9c"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 2,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 2) = 2"
+            },
+            {
+                "name": "OP_NUMEQUAL fail (only one item)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "9c"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_NUMEQUAL fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "9c"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_NUMEQUALVERIFY tests",
+        "tests": [
+            {
+                "name": "OP_NUMEQUALVERIFY success (equal one-byte)",
+                "initial stack": [
+                    "01",
+                    "01"
+                ],
+                "opcodes": [
+                    "9d"
+                ],
+                "success": true,
+                "final stack": [],
+                "varops cost": 1,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 1) = 1"
+            },
+            {
+                "name": "OP_NUMEQUALVERIFY success (equal with trailing zeros)",
+                "initial stack": [
+                    "01",
+                    "010000"
+                ],
+                "opcodes": [
+                    "9d"
+                ],
+                "success": true,
+                "final stack": [],
+                "varops cost": 3,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 3) = 3"
+            },
+            {
+                "name": "OP_NUMEQUALVERIFY success (both zero)",
+                "initial stack": [
+                    "",
+                    "00"
+                ],
+                "opcodes": [
+                    "9d"
+                ],
+                "success": true,
+                "final stack": [],
+                "varops cost": 1,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(0, 1) = 1"
+            },
+            {
+                "name": "OP_NUMEQUALVERIFY fail (different values)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "9d"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_NUMEQUALVERIFY success (long equal with trailing zeros)",
+                "initial stack": [
+                  "ff{3999999}01",
+                  "ff{3999999}01"
+                ],
+                "opcodes": [
+                  "9d"
+                ],
+                "success": true,
+                "final stack": [],
+                "varops cost": 4000000,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(4000000, 4000000) = 4000000"
+            },
+            {
+                "name": "OP_NUMEQUALVERIFY fail (same prefix, unequal)",
+                "initial stack": [
+                    "01",
+                    "0101"
+                ],
+                "opcodes": [
+                    "9d"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_NUMEQUALVERIFY fail (only one item)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "9d"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_NUMEQUALVERIFY fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "9d"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_NUMNOTEQUAL tests",
+        "tests": [
+            {
+                "name": "OP_NUMNOTEQUAL success (different one-byte values)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "9e"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 1) = 1"
+            },
+            {
+                "name": "OP_NUMNOTEQUAL success (equal with padding)",
+                "initial stack": [
+                    "01",
+                    "010000"
+                ],
+                "opcodes": [
+                    "9e"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 3,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 3) = 3"
+            },
+            {
+                "name": "OP_NUMNOTEQUAL success (both empty = equal)",
+                "initial stack": [
+                    "",
+                    ""
+                ],
+                "opcodes": [
+                    "9e"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 0,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(0, 0) = 0"
+            },
+            {
+                "name": "OP_NUMNOTEQUAL success (one empty, one padded zero = equal)",
+                "initial stack": [
+                    "",
+                    "000000"
+                ],
+                "opcodes": [
+                    "9e"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 3,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(0, 3) = 3"
+            },
+            {
+                "name": "OP_NUMNOTEQUAL success (long unequal values)",
+                "initial stack": [
+                  "ff{3999999}01",
+                  "ff{3999999}02"
+                ],
+                "opcodes": [
+                  "9e"
+                ],
+                "success": true,
+                "final stack": [
+                  "01"
+                ],
+                "varops cost": 4000000,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(4000000, 4000000) = 4000000"
+            },
+            {
+                "name": "OP_NUMNOTEQUAL fail (only one item)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "9e"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_NUMNOTEQUAL fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "9e"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_LESSTHAN tests",
+        "tests": [
+            {
+                "name": "OP_LESSTHAN success (1 < 2)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "9f"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 1) = 1"
+            },
+            {
+                "name": "OP_LESSTHAN success (2 < 1 is false)",
+                "initial stack": [
+                    "02",
+                    "01"
+                ],
+                "opcodes": [
+                    "9f"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 1,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 1) = 1"
+            },
+            {
+                "name": "OP_LESSTHAN success (trailing zeros ignored)",
+                "initial stack": [
+                    "01",
+                    "01000000"
+                ],
+                "opcodes": [
+                    "9f"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 4,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 4) = 4"
+            },
+            {
+                "name": "OP_LESSTHAN success (empty < 01)",
+                "initial stack": [
+                    "",
+                    "01"
+                ],
+                "opcodes": [
+                    "9f"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(0, 1) = 1"
+            },
+            {
+                "name": "OP_LESSTHAN success (01 < empty is false)",
+                "initial stack": [
+                    "01",
+                    ""
+                ],
+                "opcodes": [
+                    "9f"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 1,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 0) = 1"
+            },
+            {
+                "name": "OP_LESSTHAN fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "9f"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_GREATERTHAN tests",
+        "tests": [
+            {
+                "name": "OP_GREATERTHAN success (2 > 1)",
+                "initial stack": [
+                    "02",
+                    "01"
+                ],
+                "opcodes": [
+                    "a0"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 1) = 1"
+            },
+            {
+                "name": "OP_GREATERTHAN success (1 > 2 is false)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "a0"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 1,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(1, 1) = 1"
+            },
+            {
+                "name": "OP_GREATERTHAN success (trailing zeros ignored)",
+                "initial stack": [
+                    "010000",
+                    "01"
+                ],
+                "opcodes": [
+                    "a0"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 3,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) = max(3, 1) = 3"
+            }
+        ]
+    },
+    {
+        "category": "OP_LESSTHANOREQUAL tests",
+        "tests": [
+            {
+                "name": "OP_LESSTHANOREQUAL success (1 <= 2)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "a1"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1
+            },
+            {
+                "name": "OP_LESSTHANOREQUAL success (2 <= 2)",
+                "initial stack": [
+                    "02",
+                    "02"
+                ],
+                "opcodes": [
+                    "a1"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1
+            },
+            {
+                "name": "OP_LESSTHANOREQUAL success (3 <= 2 is false)",
+                "initial stack": [
+                    "03",
+                    "02"
+                ],
+                "opcodes": [
+                    "a1"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 1
+            }
+        ]
+    },
+    {
+        "category": "OP_GREATERTHANOREQUAL tests",
+        "tests": [
+            {
+                "name": "OP_GREATERTHANOREQUAL success (3 >= 2)",
+                "initial stack": [
+                    "03",
+                    "02"
+                ],
+                "opcodes": [
+                    "a2"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1
+            },
+            {
+                "name": "OP_GREATERTHANOREQUAL success (2 >= 2)",
+                "initial stack": [
+                    "02",
+                    "02"
+                ],
+                "opcodes": [
+                    "a2"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1
+            },
+            {
+                "name": "OP_GREATERTHANOREQUAL success (1 >= 2 is false)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "a2"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 1
+            },
+            {
+                "name": "OP_GREATERTHANOREQUAL fail (only one item)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "a2"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_MIN tests",
+        "tests": [
+            {
+                "name": "OP_MIN success (1 vs 2)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "a3"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 2,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) * 2 = max(1, 1) * 2 = 2"
+            },
+            {
+                "name": "OP_MIN success (3 vs 2)",
+                "initial stack": [
+                    "03",
+                    "02"
+                ],
+                "opcodes": [
+                    "a3"
+                ],
+                "success": true,
+                "final stack": [
+                    "02"
+                ],
+                "varops cost": 2,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) * 2 = max(1, 1) * 2 = 2"
+            },
+            {
+                "name": "OP_MIN success (equal values)",
+                "initial stack": [
+                    "05",
+                    "050000"
+                ],
+                "opcodes": [
+                    "a3"
+                ],
+                "success": true,
+                "final stack": [
+                    "05"
+                ],
+                "varops cost": 6,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) * 2 = max(1, 3) * 2 = 6"
+            },
+            {
+                "name": "OP_MIN success (empty and 01)",
+                "initial stack": [
+                    "",
+                    "01"
+                ],
+                "opcodes": [
+                    "a3"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 2,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) * 2 = max(0, 1) * 2 = 2"
+            },
+            {
+                "name": "OP_MIN success (empty and empty)",
+                "initial stack": [
+                    "",
+                    ""
+                ],
+                "opcodes": [
+                    "a3"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 0,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) * 2 = max(0, 0) * 2 = 0"
+            },
+            {
+                "name": "OP_MIN success (normalizes selected result)",
+                "initial stack": [
+                    "020000",
+                    "01"
+                ],
+                "opcodes": [
+                    "a3"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 6,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) * 2 = max(3, 1) * 2 = 6"
+            },
+            {
+                "name": "OP_MIN fail (only one item)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "a3"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_MIN fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "a3"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_MAX tests",
+        "tests": [
+            {
+                "name": "OP_MAX success (1 vs 2)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "a4"
+                ],
+                "success": true,
+                "final stack": [
+                    "02"
+                ],
+                "varops cost": 2,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) * 2 = max(1, 1) * 2 = 2"
+            },
+            {
+                "name": "OP_MAX success (3 vs 2)",
+                "initial stack": [
+                    "03",
+                    "02"
+                ],
+                "opcodes": [
+                    "a4"
+                ],
+                "success": true,
+                "final stack": [
+                    "03"
+                ],
+                "varops cost": 2,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) * 2 = max(1, 1) * 2 = 2"
+            },
+            {
+                "name": "OP_MAX success (equal values)",
+                "initial stack": [
+                    "050000",
+                    "05"
+                ],
+                "opcodes": [
+                    "a4"
+                ],
+                "success": true,
+                "final stack": [
+                    "05"
+                ],
+                "varops cost": 6,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) * 2 = max(3, 1) * 2 = 6"
+            },
+            {
+                "name": "OP_MAX success (empty and 01)",
+                "initial stack": [
+                    "",
+                    "01"
+                ],
+                "opcodes": [
+                    "a4"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 2,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) * 2 = max(0, 1) * 2 = 2"
+            },
+            {
+                "name": "OP_MAX success (empty and empty)",
+                "initial stack": [
+                    "",
+                    ""
+                ],
+                "opcodes": [
+                    "a4"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 0,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) * 2 = max(0, 0) * 2 = 0"
+            },
+            {
+                "name": "OP_MAX success (normalizes selected result)",
+                "initial stack": [
+                    "01",
+                    "020000"
+                ],
+                "opcodes": [
+                    "a4"
+                ],
+                "success": true,
+                "final stack": [
+                    "02"
+                ],
+                "varops cost": 6,
+                "description": "COMPARING + COMPARINGZERO: max(len(A), len(B)) * 2 = max(1, 3) * 2 = 6"
+            },
+            {
+                "name": "OP_MAX fail (only one item)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "a4"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_MAX fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "a4"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_WITHIN tests",
+        "tests": [
+            {
+                "name": "OP_WITHIN success (2 in [1, 3))",
+                "initial stack": [
+                    "02",
+                    "01",
+                    "03"
+                ],
+                "opcodes": [
+                    "a5"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 2
+            },
+            {
+                "name": "OP_WITHIN success (1 in [1, 3))",
+                "initial stack": [
+                    "01",
+                    "01",
+                    "03"
+                ],
+                "opcodes": [
+                    "a5"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 2
+            },
+            {
+                "name": "OP_WITHIN success (3 not in [1, 3))",
+                "initial stack": [
+                    "03",
+                    "01",
+                    "03"
+                ],
+                "opcodes": [
+                    "a5"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 2
+            },
+            {
+                "name": "OP_WITHIN success (0 not in [1, 3))",
+                "initial stack": [
+                    "00",
+                    "01",
+                    "03"
+                ],
+                "opcodes": [
+                    "a5"
+                ],
+                "success": true,
+                "final stack": [
+                    ""
+                ],
+                "varops cost": 2
+            },
+            {
+                "name": "OP_WITHIN success (trailing zeros ignored)",
+                "initial stack": [
+                    "01",
+                    "01000000",
+                    "0300"
+                ],
+                "opcodes": [
+                    "a5"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 6
+            },
+            {
+                "name": "OP_WITHIN success (empty values treated as 0)",
+                "initial stack": [
+                    "",
+                    "",
+                    "01"
+                ],
+                "opcodes": [
+                    "a5"
+                ],
+                "success": true,
+                "final stack": [
+                    "01"
+                ],
+                "varops cost": 1
+            },
+            {
+                "name": "OP_WITHIN fail (only two items)",
+                "initial stack": [
+                    "01",
+                    "02"
+                ],
+                "opcodes": [
+                    "a5"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_WITHIN fail (only one item)",
+                "initial stack": [
+                    "01"
+                ],
+                "opcodes": [
+                    "a5"
+                ],
+                "success": false
+            },
+            {
+                "name": "OP_WITHIN fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "a5"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_SHA256 tests",
+        "tests": [
+            {
+                "name": "OP_SHA256 success (empty string)",
+                "initial stack": [
+                    ""
+                ],
+                "opcodes": [
+                    "a8"
+                ],
+                "success": true,
+                "final stack": [
+                    "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+                ],
+                "varops cost": 0,
+                "description": "HASH: len(operand) * 10 = 0 * 10 = 0"
+            },
+            {
+                "name": "OP_SHA256 success (short string)",
+                "initial stack": [
+                    "61"
+                ],
+                "opcodes": [
+                    "a8"
+                ],
+                "success": true,
+                "final stack": [
+                    "ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"
+                ],
+                "varops cost": 10,
+                "description": "HASH: len(operand) * 10 = 1 * 10 = 10"
+            },
+            {
+                "name": "OP_SHA256 success (long input)",
+                "initial stack": [
+                  "ff{4000000}"
+                ],
+                "opcodes": [
+                  "a8"
+                ],
+                "success": true,
+                "final stack": [
+                  "1627b4013371d63d947eb27740be7cf32aad311c0116e854bbe6ec89e7185e09"
+                ],
+                "varops cost": 40000000,
+                "description": "HASH: len(operand) * 10 = 4000000 * 10 = 40000000"
+            },
+            {
+                "name": "OP_SHA256 fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "a8"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_HASH160 tests",
+        "tests": [
+            {
+                "name": "OP_HASH160 success (empty string)",
+                "initial stack": [
+                    ""
+                ],
+                "opcodes": [
+                    "a9"
+                ],
+                "success": true,
+                "final stack": [
+                    "b472a266d0bd89c13706a4132ccfb16f7c3b9fcb"
+                ],
+                "varops cost": 0,
+                "description": "HASH: len(operand) * 10 = 0 * 10 = 0"
+            },
+            {
+                "name": "OP_HASH160 success (short string)",
+                "initial stack": [
+                    "61"
+                ],
+                "opcodes": [
+                    "a9"
+                ],
+                "success": true,
+                "final stack": [
+                    "994355199e516ff76c4fa4aab39337b9d84cf12b"
+                ],
+                "varops cost": 10,
+                "description": "HASH: len(operand) * 10 = 1 * 10 = 10"
+            },
+            {
+                "name": "OP_HASH160 success (long input)",
+                "initial stack": [
+                  "ff{4000000}"
+                ],
+                "opcodes": [
+                  "a9"
+                ],
+                "success": true,
+                "final stack": [
+                  "3eb2aeb1e4836781864294138e5592505ca08d70"
+                ],
+                "varops cost": 40000000,
+                "description": "HASH: len(operand) * 10 = 4000000 * 10 = 40000000"
+            },
+            {
+                "name": "OP_HASH160 fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "a9"
+                ],
+                "success": false
+            }
+        ]
+    },
+    {
+        "category": "OP_HASH256 tests",
+        "tests": [
+            {
+                "name": "OP_HASH256 success (empty string)",
+                "initial stack": [
+                    ""
+                ],
+                "opcodes": [
+                    "aa"
+                ],
+                "success": true,
+                "final stack": [
+                    "5df6e0e2761359d30a8275058e299fcc0381534545f55cf43e41983f5d4c9456"
+                ],
+                "varops cost": 0,
+                "description": "HASH: len(operand) * 10 = 0 * 10 = 0"
+            },
+            {
+                "name": "OP_HASH256 success (short string)",
+                "initial stack": [
+                    "61"
+                ],
+                "opcodes": [
+                    "aa"
+                ],
+                "success": true,
+                "final stack": [
+                    "bf5d3affb73efd2ec6c36ad3112dd933efed63c4e1cbffcfa88e2759c144f2d8"
+                ],
+                "varops cost": 10,
+                "description": "HASH: len(operand) * 10 = 1 * 10 = 10"
+            },
+            {
+                "name": "OP_HASH256 success (long input)",
+                "initial stack": [
+                  "ff{4000000}"
+                ],
+                "opcodes": [
+                  "aa"
+                ],
+                "success": true,
+                "final stack": [
+                  "2c410c77ea4a4d13d84cdd813370d9ab4fd9dcdc5397b40b5531e792d4ad504e"
+                ],
+                "varops cost": 40000000,
+                "description": "HASH: len(operand) * 10 = 4000000 * 10 = 40000000"
+            },
+            {
+                "name": "OP_HASH256 fail (empty stack)",
+                "initial stack": [],
+                "opcodes": [
+                    "aa"
+                ],
+                "success": false
+            }
+        ]
+    }
+]
diff --git a/src/test/gsr_tests.cpp b/src/test/gsr_tests.cpp
new file mode 100644
index 000000000000..82ff1adca666
--- /dev/null
+++ b/src/test/gsr_tests.cpp
@@ -0,0 +1,345 @@
+// Copyright (c) 2025 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <test/util/setup_common.h>
+#include <test/util/json.h>
+#include <test/data/gsr_tests.json.h>
+#include <test/data/varops_tests.json.h>
+#include <test/util/script.h>
+#include <script/interpreter.h>
+#include <script/script.h>
+#include <test/util/random.h>
+#include <util/strencodings.h>
+#include <util/string.h>
+#include <util/vector.h>
+#include <univalue.h>
+#include <boost/test/unit_test.hpp>
+#include <algorithm>
+#include <ranges>
+#include <stdexcept>
+#include <script/valtype_stack.h>
+
+BOOST_FIXTURE_TEST_SUITE(gsr_tests, BasicTestingSetup)
+
+
+
+static void PrintStackComparison(const std::string& test_name,
+    const std::vector<std::vector<unsigned char>>& actual_stack,
+    const std::vector<std::vector<unsigned char>>& expected_stack)
+{
+    std::cerr << "Test '" << test_name << "' failed final stack check. Final stack:\n";
+    for (size_t i = 0; i < std::max(actual_stack.size(), expected_stack.size()); ++i) {
+        std::cerr << "  [" << i << "] ";
+        if (i < expected_stack.size()) {
+            std::cerr << "Expected: ";
+            std::ranges::for_each(expected_stack[i],
+            [](auto c) { std::cerr << std::hex << +c << " "; });
+        } else {
+            std::cerr << "Expected: No element";
+        }
+
+        std::cerr << ", ";
+
+        if (i < actual_stack.size()) {
+            std::cerr << "Actual: ";
+            std::ranges::for_each(actual_stack[i],
+            [](auto c) { std::cerr << std::hex << +c << " "; });
+        } else {
+            std::cerr << "Actual: No element";
+        }
+        std::cerr << std::dec << '\n';
+    }
+}
+
+static opcodetype GetOpCode(const std::string& name)
+{
+    // Handle numeric opcodes
+    if (name == "0") return OP_0;
+    if (name == "-1") return OP_1NEGATE;
+    for (int i = 1; i <= 16; ++i) {
+        if (name == util::ToString(i)) return static_cast<opcodetype>(OP_1 + i - 1);
+    }
+
+    // Handle named opcodes
+    if (name == "OP_PUSHDATA1") return OP_PUSHDATA1;
+    if (name == "OP_PUSHDATA2") return OP_PUSHDATA2;
+    if (name == "OP_PUSHDATA4") return OP_PUSHDATA4;
+    if (name == "OP_RESERVED") return OP_RESERVED;
+    if (name == "OP_NOP") return OP_NOP;
+    if (name == "OP_VER") return OP_VER;
+    if (name == "OP_IF") return OP_IF;
+    if (name == "OP_NOTIF") return OP_NOTIF;
+    if (name == "OP_VERIF") return OP_VERIF;
+    if (name == "OP_VERNOTIF") return OP_VERNOTIF;
+    if (name == "OP_ELSE") return OP_ELSE;
+    if (name == "OP_ENDIF") return OP_ENDIF;
+    if (name == "OP_VERIFY") return OP_VERIFY;
+    if (name == "OP_RETURN") return OP_RETURN;
+    if (name == "OP_TOALTSTACK") return OP_TOALTSTACK;
+    if (name == "OP_FROMALTSTACK") return OP_FROMALTSTACK;
+    if (name == "OP_2DROP") return OP_2DROP;
+    if (name == "OP_2DUP") return OP_2DUP;
+    if (name == "OP_3DUP") return OP_3DUP;
+    if (name == "OP_2OVER") return OP_2OVER;
+    if (name == "OP_2ROT") return OP_2ROT;
+    if (name == "OP_2SWAP") return OP_2SWAP;
+    if (name == "OP_IFDUP") return OP_IFDUP;
+    if (name == "OP_DEPTH") return OP_DEPTH;
+    if (name == "OP_DROP") return OP_DROP;
+    if (name == "OP_DUP") return OP_DUP;
+    if (name == "OP_NIP") return OP_NIP;
+    if (name == "OP_OVER") return OP_OVER;
+    if (name == "OP_PICK") return OP_PICK;
+    if (name == "OP_ROLL") return OP_ROLL;
+    if (name == "OP_ROT") return OP_ROT;
+    if (name == "OP_SWAP") return OP_SWAP;
+    if (name == "OP_TUCK") return OP_TUCK;
+    if (name == "OP_CAT") return OP_CAT;
+    if (name == "OP_SUBSTR") return OP_SUBSTR;
+    if (name == "OP_LEFT") return OP_LEFT;
+    if (name == "OP_RIGHT") return OP_RIGHT;
+    if (name == "OP_SIZE") return OP_SIZE;
+    if (name == "OP_INVERT") return OP_INVERT;
+    if (name == "OP_AND") return OP_AND;
+    if (name == "OP_OR") return OP_OR;
+    if (name == "OP_XOR") return OP_XOR;
+    if (name == "OP_EQUAL") return OP_EQUAL;
+    if (name == "OP_EQUALVERIFY") return OP_EQUALVERIFY;
+    if (name == "OP_RESERVED1") return OP_RESERVED1;
+    if (name == "OP_RESERVED2") return OP_RESERVED2;
+    if (name == "OP_1ADD") return OP_1ADD;
+    if (name == "OP_1SUB") return OP_1SUB;
+    if (name == "OP_2MUL") return OP_2MUL;
+    if (name == "OP_2DIV") return OP_2DIV;
+    if (name == "OP_NEGATE") return OP_NEGATE;
+    if (name == "OP_ABS") return OP_ABS;
+    if (name == "OP_NOT") return OP_NOT;
+    if (name == "OP_0NOTEQUAL") return OP_0NOTEQUAL;
+    if (name == "OP_ADD") return OP_ADD;
+    if (name == "OP_SUB") return OP_SUB;
+    if (name == "OP_MUL") return OP_MUL;
+    if (name == "OP_DIV") return OP_DIV;
+    if (name == "OP_MOD") return OP_MOD;
+    if (name == "OP_LSHIFT") return OP_LSHIFT;
+    if (name == "OP_RSHIFT") return OP_RSHIFT;
+    if (name == "OP_BOOLAND") return OP_BOOLAND;
+    if (name == "OP_BOOLOR") return OP_BOOLOR;
+    if (name == "OP_NUMEQUAL") return OP_NUMEQUAL;
+    if (name == "OP_NUMEQUALVERIFY") return OP_NUMEQUALVERIFY;
+    if (name == "OP_NUMNOTEQUAL") return OP_NUMNOTEQUAL;
+    if (name == "OP_LESSTHAN") return OP_LESSTHAN;
+    if (name == "OP_GREATERTHAN") return OP_GREATERTHAN;
+    if (name == "OP_LESSTHANOREQUAL") return OP_LESSTHANOREQUAL;
+    if (name == "OP_GREATERTHANOREQUAL") return OP_GREATERTHANOREQUAL;
+    if (name == "OP_MIN") return OP_MIN;
+    if (name == "OP_MAX") return OP_MAX;
+    if (name == "OP_WITHIN") return OP_WITHIN;
+    if (name == "OP_RIPEMD160") return OP_RIPEMD160;
+    if (name == "OP_SHA1") return OP_SHA1;
+    if (name == "OP_SHA256") return OP_SHA256;
+    if (name == "OP_HASH160") return OP_HASH160;
+    if (name == "OP_HASH256") return OP_HASH256;
+    if (name == "OP_CODESEPARATOR") return OP_CODESEPARATOR;
+    if (name == "OP_CHECKSIG") return OP_CHECKSIG;
+    if (name == "OP_CHECKSIGVERIFY") return OP_CHECKSIGVERIFY;
+    if (name == "OP_CHECKMULTISIG") return OP_CHECKMULTISIG;
+    if (name == "OP_CHECKMULTISIGVERIFY") return OP_CHECKMULTISIGVERIFY;
+    if (name == "OP_NOP1") return OP_NOP1;
+    if (name == "OP_CHECKLOCKTIMEVERIFY") return OP_CHECKLOCKTIMEVERIFY;
+    if (name == "OP_CHECKSEQUENCEVERIFY") return OP_CHECKSEQUENCEVERIFY;
+    if (name == "OP_NOP4") return OP_NOP4;
+    if (name == "OP_NOP5") return OP_NOP5;
+    if (name == "OP_NOP6") return OP_NOP6;
+    if (name == "OP_NOP7") return OP_NOP7;
+    if (name == "OP_NOP8") return OP_NOP8;
+    if (name == "OP_NOP9") return OP_NOP9;
+    if (name == "OP_NOP10") return OP_NOP10;
+    if (name == "OP_CHECKSIGADD") return OP_CHECKSIGADD;
+    if (name == "OP_INVALIDOPCODE") return OP_INVALIDOPCODE;
+
+    throw std::invalid_argument("Unknown opcode name: " + name);
+}
+
+static std::vector<unsigned char> ParseHexOrOpcode(const std::string& input)
+{
+    // Try to parse as opcode name first
+    try {
+        opcodetype opcode = GetOpCode(input);
+        return {static_cast<unsigned char>(opcode)};
+    } catch (const std::exception&) {
+        // If opcode parsing fails, try to parse as hex
+    }
+
+    // Fall back to hex parsing
+    return ParseHex(input);
+}
+
+static std::vector<unsigned char> ParseHex(const std::string& hex)
+{
+    std::vector<unsigned char> result;
+    if (hex.empty()) {
+        return result;
+    }
+
+    // Strip "0x" prefix if present
+    std::string hex_data = hex;
+    if (hex_data.length() >= 2 && hex_data[0] == '0' && (hex_data[1] == 'x' || hex_data[1] == 'X')) {
+        hex_data = hex_data.substr(2);
+    }
+
+    // Empty string after stripping prefix means empty byte vector
+    if (hex_data.empty()) {
+        return result;
+    }
+
+    result.reserve(hex_data.length() / 2);
+
+    for (size_t i = 0; i < hex_data.length(); ) {
+        // Check for expansion notation {n}
+        if (i < hex_data.length() && hex_data[i] == '{') {
+            // Find the closing brace
+            size_t close_brace = hex_data.find('}', i);
+            if (close_brace == std::string::npos) {
+                throw std::invalid_argument("Unclosed brace in hex string");
+            }
+
+            std::string count_str = hex_data.substr(i + 1, close_brace - i - 1);
+            auto repeat_count_opt = ToIntegral<uint64_t>(count_str);
+            if (!repeat_count_opt) {
+                throw std::invalid_argument("Invalid repeat count");
+            }
+            uint64_t repeat_count = *repeat_count_opt - 1;
+
+            if (result.empty()) {
+                throw std::invalid_argument("No previous byte to repeat");
+            }
+            unsigned char prev_byte = result.back();
+
+            for (uint64_t j = 0; j < repeat_count; ++j) {
+                result.push_back(prev_byte);
+            }
+
+            i = close_brace + 1;
+        } else {
+            // Normal hex byte parsing
+            if (i + 1 >= hex_data.length()) {
+                throw std::invalid_argument("Incomplete hex byte");
+            }
+            unsigned char byte_val = 0;
+            auto [ptr, ec] = std::from_chars(hex_data.data() + i, hex_data.data() + i + 2, byte_val, 16);
+            if (ec != std::errc{}) {
+                throw std::invalid_argument("Invalid hex byte");
+            }
+            result.push_back(byte_val);
+            i += 2;
+        }
+    }
+    return result;
+}
+
+static void RunJsonTests(const UniValue& tests, const std::string& suite_name, bool check_varops_budget = false)
+{
+    for (const UniValue& category_val : tests.getValues()) {
+        std::string category_name = category_val["category"].get_str();
+
+        for (const UniValue& test : category_val["tests"].getValues()) {
+            std::string test_name = test["name"].get_str();
+            std::string full_test_name = suite_name + "::" + test_name;
+
+            try {
+
+            CScript script;
+            for (const UniValue& opcode_input : test["opcodes"].getValues()) {
+                try {
+                    const std::string& input_str = opcode_input.get_str();
+                    auto parsed_opcodes = ParseHexOrOpcode(input_str);
+                    script.insert(script.end(), parsed_opcodes.cbegin(), parsed_opcodes.cend());
+                } catch (const std::exception& e) {
+                    std::cerr << "Failed parsing opcode '" << opcode_input.get_str() << "' in test '" << full_test_name << "': " << e.what() << std::endl;
+                    throw;
+                }
+            }
+
+            std::vector<std::vector<unsigned char>> initial_stack;
+            if (test.exists("initial stack")) {
+                const std::vector<UniValue>& stack_items = test["initial stack"].getValues();
+                initial_stack.reserve(stack_items.size());
+                for (const auto& item : stack_items) {
+                    try {
+                        initial_stack.push_back(ParseHex(item.get_str()));
+                    } catch (const std::exception& e) {
+                        std::cerr << "Failed parsing initial stack item '" << item.get_str() << "' in test '" << full_test_name << "': " << e.what() << std::endl;
+                        throw;
+                    }
+                }
+            }
+
+            bool expected_success = test["success"].get_bool();
+
+            std::vector<std::vector<unsigned char>> expected_final_stack;
+            uint64_t expected_varops_budget_consumed = 0;
+
+            if (expected_success) {
+                if (test.exists("final stack")) {
+                    const auto& final_stack_items = test["final stack"].getValues();
+                    expected_final_stack.reserve(final_stack_items.size());
+                    for (const auto& item : final_stack_items) {
+                        try {
+                            expected_final_stack.push_back(ParseHex(item.get_str()));
+                        } catch (const std::exception& e) {
+                            std::cerr << "Failed parsing final stack item '" << item.get_str() << "' in test '" << full_test_name << "': " << e.what() << std::endl;
+                            throw;
+                        }
+                    }
+                }
+                if (test.exists("varops cost")) {
+                    expected_varops_budget_consumed = test["varops cost"].getInt<uint64_t>();
+                }
+            }
+
+            std::vector<std::vector<unsigned char>> stack = initial_stack;
+            ScriptExecutionData sdata;
+            ScriptError serror = SCRIPT_ERR_OK;
+            BaseSignatureChecker checker;
+
+            constexpr uint64_t budget = 100'000'000;
+            uint64_t varops_budget = budget;
+            ValtypeStack valtype_stack{stack};
+            bool success = EvalGsrScript(valtype_stack, script, 0, checker, SigVersion::TAPSCRIPT_V2, sdata, varops_budget, &serror);
+
+            BOOST_CHECK_MESSAGE(success == expected_success, "Test '" << full_test_name << "' failed success check.");
+
+            stack = valtype_stack.get_stack();
+            if (expected_success) {
+                if (stack != expected_final_stack) {
+                    PrintStackComparison(full_test_name, stack, expected_final_stack);
+                }
+                BOOST_CHECK_MESSAGE(stack == expected_final_stack, "Test '" << full_test_name << "' failed final stack check.");
+                if (check_varops_budget) {
+                    uint64_t budget_consumed = budget - varops_budget;
+                    BOOST_CHECK_MESSAGE(budget_consumed == expected_varops_budget_consumed, "Test '" << full_test_name << "' failed varops cost check. budget_consumed: " << budget_consumed << ", Expected: " << expected_varops_budget_consumed);
+                }
+            }
+
+            } catch (const std::exception& e) {
+                std::cerr << "Exception in test '" << full_test_name << "' (category: '" << category_name << "'): " << e.what() << std::endl;
+                throw;
+            }
+        }
+    }
+}
+
+BOOST_AUTO_TEST_CASE(varops_json_tests)
+{
+    UniValue varops_tests = read_json(json_tests::varops_tests);
+    RunJsonTests(varops_tests, "varops_tests", true);
+}
+
+BOOST_AUTO_TEST_CASE(gsr_json_tests)
+{
+    UniValue gsr_tests = read_json(json_tests::gsr_tests);
+    RunJsonTests(gsr_tests, "gsr_tests", true);
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/script_tests.cpp b/src/test/script_tests.cpp
index 0846122e6cc4..082e0b12e3ca 100644
--- a/src/test/script_tests.cpp
+++ b/src/test/script_tests.cpp
@@ -25,7 +25,9 @@
 #include <util/fs.h>
 #include <util/strencodings.h>
 #include <util/string.h>
+#include <script/valtype_stack.h>
 
+#include <chrono>
 #include <cstdint>
 #include <fstream>
 #include <string>
@@ -34,6 +36,7 @@
 #include <boost/test/unit_test.hpp>
 
 #include <univalue.h>
+#include <script/val64.h>
 
 // Uncomment if you want to output updated JSON tests.
 // #define UPDATE_JSON_TESTS
@@ -1838,4 +1841,81 @@ BOOST_AUTO_TEST_CASE(cat_dup_test)
     }
 }
 
+static size_t get_val(size_t default_val, const char *var)
+{
+    const char *env = getenv(var);
+    if (!env)
+        return default_val;
+    auto val = ToIntegral<long>(env);
+    if (!val || *val == 0)
+        return default_val;
+    return static_cast<size_t>(*val);
+}
+
+static void BenchEvalScript(const CScript &script,
+                            const std::vector<unsigned char> &op1,
+                            const std::vector<unsigned char> &op2,
+                            const char *name)
+{
+    BaseSignatureChecker checker;
+    ScriptExecutionData sdata;
+    ScriptError serror;
+    size_t cooling = get_val(0, "EVALSCRIPT_COOLING_BYTES");
+
+    std::vector<unsigned char> cool1(cooling/2, cooling/7), cool2(cooling/2, cooling/15);
+    if (cooling/2)
+        std::cerr << "Cooling using " << cooling << "bytes!" << std::endl;
+
+    using namespace std::chrono;
+
+    for (int i = 0; i < 10; ++i) {
+        std::vector<std::vector<unsigned char> > stack(2);
+
+        stack[0] = op2;
+        for (size_t i = 0; i < stack[0].size(); i++)
+            stack[0][i] += static_cast<unsigned char>(cooling++);
+
+        // In case we want to clear cache.
+        for (size_t i = 0; i < cool1.size(); i++) {
+            cool1[i] += static_cast<unsigned char>(cooling);
+            cool2[i] += static_cast<unsigned char>(cooling);
+        }
+
+        // Set up stack: this does a copy, so these won't be cold.
+        stack[1] = op1;
+        for (size_t i = 0; i < stack[1].size(); i++)
+            stack[1][i] += static_cast<unsigned char>(cooling++);
+
+        uint64_t varops_budget = 1e10;
+        ValtypeStack valtype_stack{stack};
+        if (!EvalGsrScript(valtype_stack, script, 0, checker,
+                        SigVersion::TAPSCRIPT_V2, sdata, varops_budget, &serror)) {
+            std::cerr << "EvalScript error " << ScriptErrorString(serror) << std::endl;
+            assert(0);
+        }
+    }
+
+    assert(cooling);
+}
+
+BOOST_AUTO_TEST_CASE(invert_cold)
+{
+    std::vector<unsigned char> op1(4000000), op2(4000000);
+    CScript script;
+
+    script << OP_DROP << OP_INVERT;
+
+    BenchEvalScript(script, op1, op2, "invert_cold");
+}
+
+BOOST_AUTO_TEST_CASE(invert_hot)
+{
+    std::vector<unsigned char> op1(4000000), op2(4000000);
+    CScript script;
+
+    script << OP_INVERT;
+
+    BenchEvalScript(script, op1, op2, "invert_hot");
+}
+
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/util/setup_common.cpp b/src/test/util/setup_common.cpp
index 06c1d50447a9..d3fdc585634e 100644
--- a/src/test/util/setup_common.cpp
+++ b/src/test/util/setup_common.cpp
@@ -5,6 +5,7 @@
 #include <test/util/setup_common.h>
 
 #include <addrman.h>
+#include <script/val64.h>
 #include <banman.h>
 #include <chainparams.h>
 #include <common/system.h>
@@ -114,6 +115,8 @@ BasicTestingSetup::BasicTestingSetup(const ChainType chainType, TestOpts opts)
     if (!EnableFuzzDeterminism()) {
         SeedRandomForTest(SeedRand::FIXED_SEED);
     }
+
+    Val64::suppress_alignment_warnings = true;
     m_node.shutdown_signal = &m_interrupt;
     m_node.shutdown_request = [this]{ return m_interrupt(); };
     m_node.args = &gArgs;
diff --git a/src/test/val64_tests.cpp b/src/test/val64_tests.cpp
new file mode 100644
index 000000000000..b12d739d77e0
--- /dev/null
+++ b/src/test/val64_tests.cpp
@@ -0,0 +1,1211 @@
+// Copyright (c) 2011-2022 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <test/data/val64_conversion.json.h>
+#include <script/val64.h>
+#include <test/util/json.h>
+#include <test/util/random.h>
+#include <test/util/setup_common.h>
+#include <util/vector.h>
+
+#include <univalue.h>
+
+#include <boost/test/unit_test.hpp>
+#include <string>
+
+BOOST_FIXTURE_TEST_SUITE(val64_tests, BasicTestingSetup)
+
+// Resize/create vector so this bit will fit
+static std::vector<unsigned char> vec_sized_for_bit(size_t bit,
+                                                    const std::vector<unsigned char> in = std::vector<unsigned char>())
+{
+    std::vector<unsigned char> v = in;
+    if (v.size() < (bit + 8) / 8)
+        v.resize((bit + 8) / 8);
+    return v;
+}
+
+// Set bit or create vector with this bit set.
+static std::vector<unsigned char> vec_setbit(size_t bit,
+                                             const std::vector<unsigned char> in = std::vector<unsigned char>())
+{
+    std::vector<unsigned char> v = vec_sized_for_bit(bit, in);
+    v[bit / 8] |= (1 << (bit % 8));
+    return v;
+}
+
+// Helper function to convert a vector to a string for printing (ChatGPT)
+template <typename T>
+std::string vector_to_string(const std::vector<T>& vec) {
+    std::ostringstream oss;
+    for (const auto& item : vec) {
+        oss << static_cast<int>(item) << " ";
+    }
+    return oss.str();
+}
+
+// A de-privatizing child.  Not efficient, as constructor copies, but convenient for testing.
+class Val64Test: public Val64 {
+public:
+    // Unlike Val64, this makes a copy.
+    Val64Test(std::vector<unsigned char> v): Val64(v) { };
+    Val64Test(const Val64Test &) = default;
+    Val64Test(uint64_t v): Val64(v) { };
+    Val64Test() = default;
+
+    std::span<le64_t> span() const { return Val64::m_u64span; }
+    size_t u64_size() const { return Val64::m_u64span.size(); }
+    size_t realsize() const { return Val64::m_realsize; }
+    uint64_t get(size_t i) const { return Val64::get(i); }
+    static void set_force_unaligned(bool val) { Val64::force_unaligned = val; }
+    static void set_suppress_alignment_warnings(bool val) { Val64::suppress_alignment_warnings = val; }
+    static void set_force_portable_math(bool val) { Val64::force_portable_math = val; }
+
+    void set(size_t index, uint64_t v) { Val64::set(index, v); }
+    const uint64_t *access_u64() const { return m_u64span.data(); }
+    static void mul_span(std::span<le64_t> res, const std::span<le64_t> src, uint64_t mul) { return Val64::mul_span(res, src, mul); }
+    static bool add_span(std::span<uint64_t> v1, const std::span<uint64_t> v2, size_t &nonzero_len) { return Val64::add_span(v1, v2, nonzero_len); }
+    static bool sub_span(std::span<uint64_t> v1, const std::span<uint64_t> v2, size_t &nonzero_len) { return Val64::sub_span(v1, v2, nonzero_len); }
+    static int cmp_span(const std::span<le64_t> v1, const std::span<le64_t> v2) { return Val64::cmp_span(v1, v2); }
+    std::vector<uint64_t> copy_vector() {
+        std::vector<uint64_t> v;
+        v.reserve(u64_size());
+        for (size_t i = 0; i < u64_size(); i++) {
+            v.push_back(get(i));
+        }
+        return v;
+    }
+};
+
+static Val64Test val64_singleton(uint64_t val)
+{
+    std::vector<unsigned char> bitvec(8);
+    Val64Test v(bitvec);
+    v.set(0, val);
+
+    return v;
+}
+
+#ifdef USE_GMP
+#include <gmp.h>
+
+static void vector_to_mpz(const std::vector<unsigned char>& vec, mpz_t &num)
+{
+    mpz_init(num);
+    mpz_import(num, vec.size(), -1, sizeof(vec[0]), 0, 0, vec.data());
+}
+
+// Because mpz will trim zeroes, we might want to pad to len
+static std::vector<unsigned char> mpz_to_vector(const mpz_t &num, size_t len = -1)
+{
+    size_t count;
+    void *raw_data = mpz_export(nullptr, &count, -1, sizeof(uint8_t), 0, 0, num);
+    std::vector<unsigned char> vec(count);
+    memcpy(vec.data(), raw_data, count);
+    free(raw_data);
+
+    if (len != (size_t)-1) {
+        assert(vec.size() <= len);
+        vec.resize(len);
+    }
+    return vec;
+}
+#endif // USE_GMP
+
+// Boost unit test is terrible.
+#define I_KNOW_HOW_TO_USE_A_DEBUGGER
+
+#ifdef I_KNOW_HOW_TO_USE_A_DEBUGGER
+#define CHECK(x) assert(x)
+#else
+#define CHECK(x) BOOST_CHECK(x)
+#endif
+
+// FIXME: Make this a template
+static std::vector<unsigned char> ParseVec8(const UniValue &arr)
+{
+    std::vector<unsigned char> ret;
+    ret.reserve(arr.size());
+    for (size_t i = 0; i < arr.size(); i++) {
+        ret.push_back(arr[i].getInt<unsigned char>());
+    }
+    return ret;
+}
+
+static std::vector<uint64_t> ParseVec64(const UniValue &arr)
+{
+    std::vector<uint64_t> ret;
+    ret.reserve(arr.size());
+    for (size_t i = 0; i < arr.size(); i++) {
+        ret.push_back(arr[i].getInt<uint64_t>());
+    }
+    return ret;
+}
+
+BOOST_AUTO_TEST_CASE(val64_valtype_conversion)
+{
+    Val64Test::set_suppress_alignment_warnings(true);
+    UniValue tests = read_json(json_tests::val64_conversion);
+
+    for (unsigned int idx = 0; idx < tests.size(); idx++) {
+        const UniValue& test = tests[idx];
+
+        for (bool unaligned: {false, true}) {
+            Val64Test::set_force_unaligned(unaligned);
+
+            // JSON: COMMENT, u8-arr, u64-arr
+            const std::vector<unsigned char> v_in = ParseVec8(test[1].get_array());
+            std::vector<uint64_t> v_out = ParseVec64(test[2].get_array());
+
+            // Check that we get expected u64 vector (make a copy, we mangle it!)
+            Val64Test test_v64(v_in);
+            std::vector<uint64_t> v64 = test_v64.copy_vector();
+            CHECK(v64 == v_out);
+
+            // We should get vector back!
+            std::vector<unsigned char> v_ret = test_v64.move_to_valtype();
+            CHECK(v_ret == v_in);
+        }
+    }
+    Val64Test::set_force_unaligned(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_unaligned)
+{
+    Val64Test::set_suppress_alignment_warnings(true);
+    Val64Test::set_force_unaligned(true);
+
+    std::vector<unsigned char> v_in_empty;
+    std::vector<unsigned char> v_in_small = {1,2,3};
+    std::vector<unsigned char> v_in_word = {1,2,3,4,5,6,7,8};
+    std::vector<unsigned char> v_in_large = {1,2,3,4,5,6,7,8,9};
+
+    // We don't mess with empty vectors (they're always "aligned")
+    Val64Test v1(v_in_empty);
+    CHECK(v1.u64_size() == 0);
+
+    Val64Test v2(v_in_small);
+    CHECK(v2.u64_size() == 1);
+
+    CHECK(v2.get(0) == 0x0000000000030201);
+
+    Val64Test v3(v_in_word);
+    CHECK(v3.u64_size() == 1);
+
+    CHECK(v3.get(0) == 0x0807060504030201);
+
+    Val64Test v4(v_in_large);
+    CHECK(v4.u64_size() == 2);
+
+    CHECK(v4.get(0) == 0x0807060504030201);
+    CHECK(v4.get(1) == 0x0000000000000009);
+
+    Val64Test::set_force_unaligned(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_and_or_xor)
+{
+    Val64Test::set_suppress_alignment_warnings(true);
+    // FIXME: Test varcosts!
+    size_t varcost = 0;
+    for (bool unaligned: {false, true}) {
+        Val64Test::set_force_unaligned(unaligned);
+
+        for (size_t i = 0; i < 128; i++) {
+            for (size_t j = 0; j < 128; j++) {
+                std::vector<unsigned char> expected_and, expected_or, expected_xor;
+
+                expected_or = vec_setbit(j, vec_setbit(i, expected_or));
+                if (i != j) {
+                    expected_and = vec_sized_for_bit(i, vec_sized_for_bit(j));
+                    expected_xor = expected_or;
+                } else {
+                    expected_and = vec_setbit(i);
+                    expected_xor = vec_sized_for_bit(i);
+                }
+
+                // AND test
+                {
+                    Val64Test v64a(vec_setbit(i));
+                    Val64Test v64b(vec_setbit(j));
+                    Val64::op_and(v64a, v64b, varcost);
+                    CHECK(v64a.move_to_valtype() == expected_and);
+                }
+
+                // OR test
+                {
+                    Val64Test v64a(vec_setbit(i));
+                    Val64Test v64b(vec_setbit(j));
+                    Val64::op_or(v64a, v64b, varcost);
+                    CHECK(v64a.move_to_valtype() == expected_or);
+                }
+
+                // XOR test
+                {
+                    Val64Test v64a(vec_setbit(i));
+                    Val64Test v64b(vec_setbit(j));
+                    Val64::op_xor(v64a, v64b, varcost);
+                    CHECK(v64a.move_to_valtype() == expected_xor);
+                }
+            }
+        }
+
+
+#ifdef USE_GMP
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = InsecureRandRange(50);
+            size_t len2 = InsecureRandRange(50);
+
+            std::vector<unsigned char> v1 =    g_insecure_rand_ctx.randbytes(len1);
+            std::vector<unsigned char> v2 =    g_insecure_rand_ctx.randbytes(len2);
+
+            // GMP version
+            mpz_t mpz1, mpz2, mpz_result_and, mpz_result_or, mpz_result_xor;
+            vector_to_mpz(v1, mpz1);
+            vector_to_mpz(v2, mpz2);
+            mpz_init(mpz_result_and);
+            mpz_and(mpz_result_and, mpz1, mpz2);
+            mpz_init(mpz_result_or);
+            mpz_ior(mpz_result_or, mpz1, mpz2);
+            mpz_init(mpz_result_xor);
+            mpz_xor(mpz_result_xor, mpz1, mpz2);
+
+            // We preserve length.
+            size_t expected_len = std::max(len1, len2);
+            std::vector<uint8_t> expect_and = mpz_to_vector(mpz_result_and, expected_len);
+            std::vector<uint8_t> expect_or = mpz_to_vector(mpz_result_or, expected_len);
+            std::vector<uint8_t> expect_xor = mpz_to_vector(mpz_result_xor, expected_len);
+            mpz_clears(mpz1, mpz2, mpz_result_and, mpz_result_or, mpz_result_xor, NULL);
+
+            // AND
+            {
+                Val64Test v64a(v1);
+                Val64Test v64b(v2);
+                Val64::op_and(v64a, v64b, varcost);
+                CHECK(v64a.move_to_valtype() == expect_and);
+            }
+
+            // OR
+            {
+                Val64Test v64a(v1);
+                Val64Test v64b(v2);
+                Val64::op_or(v64a, v64b, varcost);
+                CHECK(v64a.move_to_valtype() == expect_or);
+            }
+
+            // XOR
+            {
+                Val64Test v64a(v1);
+                Val64Test v64b(v2);
+                Val64::op_xor(v64a, v64b, varcost);
+                CHECK(v64a.move_to_valtype() == expect_xor);
+            }
+        }
+#endif
+    }
+    Val64Test::set_suppress_alignment_warnings(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_add)
+{
+    Val64Test::set_suppress_alignment_warnings(true);
+    // FIXME: Test varcosts!
+    size_t varcost = 0;
+    for (bool unaligned: {false, true}) {
+        Val64Test::set_force_unaligned(unaligned);
+
+        // Add two bits, check result.
+        for (size_t i = 0; i < 128; i++) {
+            for (size_t j = 0; j < 128; j++) {
+                Val64Test v64a(vec_setbit(i));
+                Val64Test v64b(vec_setbit(j));
+                Val64::op_add(v64a, v64b, varcost);
+
+                // Check against expected vector.
+                std::vector<unsigned char> expected;
+                if (i != j) {
+                    expected = vec_setbit(i);
+                    expected = vec_setbit(j, expected);
+                } else {
+                    expected = vec_setbit(i + 1);
+                }
+                CHECK(v64a.move_to_valtype() == expected);
+            }
+        }
+
+        // Overflow tests.
+        for (size_t i = 1; i < 24; i++) {
+            std::vector<unsigned char> almost(i, 0xff);
+            std::vector<unsigned char> one{1};
+
+            Val64 v64a(almost);
+            Val64 v64b(one);
+            Val64::op_add(v64a, v64b, varcost);
+            std::vector<unsigned char> res = v64a.move_to_valtype();
+
+            std::vector<unsigned char> expect(i, 0);
+            expect.push_back(1);
+
+            CHECK(res == expect);
+        }
+
+#ifdef USE_GMP
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = InsecureRandRange(50);
+            size_t len2 = InsecureRandRange(50);
+
+            std::vector<unsigned char> v1 =    g_insecure_rand_ctx.randbytes(len1);
+            std::vector<unsigned char> v2 =    g_insecure_rand_ctx.randbytes(len2);
+
+            BOOST_TEST_MESSAGE("Adding " << vector_to_string(v1) << " + " << vector_to_string(v2));
+
+            // GMP version
+            mpz_t mpz1, mpz2, mpz_result;
+            vector_to_mpz(v1, mpz1);
+            vector_to_mpz(v2, mpz2);
+            mpz_init(mpz_result);
+            mpz_add(mpz_result, mpz1, mpz2);
+            std::vector<uint8_t> expect = mpz_to_vector(mpz_result);
+            mpz_clears(mpz1, mpz2, mpz_result, NULL);
+
+            // Val64 version
+            Val64 v64_1(v1), v64_2(v2);
+
+            Val64::op_add(v64_1, v64_2, varcost);
+            std::vector<unsigned char> res = v64_1.move_to_valtype();
+
+            CHECK(res == expect);
+        }
+#endif
+    }
+    Val64Test::set_suppress_alignment_warnings(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_sub)
+{
+    // FIXME: Test varcosts!
+    size_t varcost = 0;
+    for (bool unaligned: {false, true}) {
+        Val64Test::set_force_unaligned(unaligned);
+
+        // Sub zero (unchanged).
+        for (size_t i = 0; i < 128; i++) {
+            const std::vector<unsigned char> zero;
+
+            // Subtract 0, should not change.
+            Val64Test v64a(vec_setbit(i));
+            Val64Test v64zero(zero);
+
+            bool res = Val64::op_sub(v64a, v64zero, varcost);
+            CHECK(res);
+
+            CHECK(v64a.move_to_valtype() == vec_setbit(i));
+        }
+
+        // Sub one.
+        for (size_t i = 63; i < 128; i++) {
+            const std::vector<unsigned char> one{1};
+
+            Val64Test v64a(vec_setbit(i));
+            Val64Test v64one(one);
+
+            bool res = Val64::op_sub(v64a, v64one, varcost);
+            CHECK(res);
+
+            std::vector<unsigned char> expected;
+            for (size_t j = 0; j < i; j++)
+                expected = vec_setbit(j, expected);
+
+            std::vector<unsigned char> va = v64a.move_to_valtype();
+            BOOST_TEST_MESSAGE("i is " << i << " expected " << vector_to_string(expected) << " got " << vector_to_string(va));
+            CHECK(va == expected);
+        }
+
+#ifdef USE_GMP
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = InsecureRandRange(50);
+            size_t len2 = InsecureRandRange(50);
+
+            std::vector<unsigned char> v1 =    g_insecure_rand_ctx.randbytes(len1);
+            std::vector<unsigned char> v2 =    g_insecure_rand_ctx.randbytes(len2);
+
+            BOOST_TEST_MESSAGE("Subtracting " << vector_to_string(v1) << " - " << vector_to_string(v2));
+
+            // GMP version
+            mpz_t mpz1, mpz2, mpz_result;
+            vector_to_mpz(v1, mpz1);
+            vector_to_mpz(v2, mpz2);
+            mpz_init(mpz_result);
+            mpz_sub(mpz_result, mpz1, mpz2);
+            std::vector<uint8_t> expect = mpz_to_vector(mpz_result);
+            bool expect_neg = (mpz_sgn(mpz_result) == -1);
+            mpz_clears(mpz1, mpz2, mpz_result, NULL);
+
+            // Val64 version
+            Val64 v64_1(v1), v64_2(v2);
+
+            bool neg = !Val64::op_sub(v64_1, v64_2, varcost);
+            std::vector<unsigned char> res = v64_1.move_to_valtype();
+
+            if (expect_neg) {
+                CHECK(neg == true);
+            } else {
+                CHECK(neg == false);
+                CHECK(res == expect);
+            }
+        }
+#endif
+    }
+    Val64Test::set_suppress_alignment_warnings(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_cmp)
+{
+    // FIXME: Test varcosts!
+    size_t varcost = 0;
+    for (bool unaligned: {false, true}) {
+        Val64Test::set_force_unaligned(unaligned);
+
+        for (size_t i = 0; i < 128; i++) {
+            for (size_t j = 0; j < 128; j++) {
+                std::vector<unsigned char> va = vec_setbit(i);
+                std::vector<unsigned char> vb = vec_setbit(j);
+                BOOST_TEST_MESSAGE("Cmp " << vector_to_string(va) << " vs " << vector_to_string(vb));
+
+                Val64 v64a(va);
+                Val64 v64b(vb);
+                int res = v64a.cmp(v64b, varcost);
+
+                int expected;
+                if (i == j)
+                    expected = 0;
+                else if (i > j)
+                    expected = 1;
+                else
+                    expected = -1;
+
+                BOOST_TEST_MESSAGE("Got " << res << " expected " << expected);
+
+                CHECK(res == expected);
+            }
+        }
+
+
+#ifdef USE_GMP
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = InsecureRandRange(50);
+            size_t len2 = InsecureRandRange(50);
+
+            std::vector<unsigned char> v1 =    g_insecure_rand_ctx.randbytes(len1);
+            std::vector<unsigned char> v2 =    g_insecure_rand_ctx.randbytes(len2);
+
+            BOOST_TEST_MESSAGE("Cmp " << vector_to_string(v1) << " vs " << vector_to_string(v2));
+
+            // GMP version
+            mpz_t mpz1, mpz2;
+            vector_to_mpz(v1, mpz1);
+            vector_to_mpz(v2, mpz2);
+
+            int expected = mpz_cmp(mpz1, mpz2);
+            // Documentation says negative, zero or positive.  Normalize!
+            if (expected > 0)
+                expected = 1;
+            else if (expected < 0)
+                expected = -1;
+            mpz_clears(mpz1, mpz2, NULL);
+
+            // Val64 version
+            Val64Test v64_1(v1), v64_2(v2);
+
+            int res = v64_1.cmp(v64_2, varcost);
+
+            CHECK(res == expected);
+        }
+#endif
+    }
+    Val64Test::set_suppress_alignment_warnings(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_upshift)
+{
+    // FIXME: Test varcosts!
+    size_t varcost = 0;
+    for (bool unaligned: {false, true}) {
+        Val64Test::set_force_unaligned(unaligned);
+
+        for (size_t i = 0; i < 128; i++) {
+            for (size_t j = 0; j < 128; j++) {
+                std::vector<unsigned char> va = vec_setbit(i);
+                BOOST_TEST_MESSAGE("Upshift " << vector_to_string(va) << " by " << j);
+
+                Val64 v64a(va);
+                bool ok = Val64::op_upshift(v64a, val64_singleton(j), 1000, varcost);
+                assert(ok);
+                va = v64a.move_to_valtype();
+
+                std::vector<unsigned char> expected = vec_setbit(i + j);
+                // Definitionally, upshift inserts an extra (j + 7) / 8 bytes.
+                expected.resize(1 + i / 8 + (j + 7) / 8);
+
+                BOOST_TEST_MESSAGE("Got " << vector_to_string(va) << " expected " << vector_to_string(expected));
+
+                CHECK(va == expected);
+            }
+        }
+
+
+#ifdef USE_GMP
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = InsecureRandRange(500);
+            size_t sbits = InsecureRandRange(500 * 8);
+
+            std::vector<unsigned char> v1 =    g_insecure_rand_ctx.randbytes(len1);
+
+            BOOST_TEST_MESSAGE("Left shifting " << vector_to_string(v1) << " by " << sbits);
+
+            // GMP version
+            mpz_t mpz1, mpz_result;
+            vector_to_mpz(v1, mpz1);
+            mpz_init(mpz_result);
+            mpz_mul_2exp(mpz_result, mpz1, sbits);
+
+            // Always leaves trailing zeroes
+            std::vector<uint8_t> expect = mpz_to_vector(mpz_result, len1 + sbits / 8 + (sbits % 8 ? 1 : 0));
+            mpz_clears(mpz1, mpz_result, NULL);
+
+            // Val64 version
+            Val64 v64(v1);
+            bool ok = Val64::op_upshift(v64, val64_singleton(sbits), 5000, varcost);
+            assert(ok);
+            v1 = v64.move_to_valtype();
+
+            CHECK(v1 == expect);
+        }
+#endif
+    }
+    Val64Test::set_suppress_alignment_warnings(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_downshift)
+{
+    // FIXME: Test varcosts!
+    size_t varcost = 0;
+    for (bool unaligned: {false, true}) {
+        Val64Test::set_force_unaligned(unaligned);
+
+        for (size_t i = 0; i < 128; i++) {
+            for (size_t j = 0; j < 128; j++) {
+                std::vector<unsigned char> va = vec_setbit(i);
+                BOOST_TEST_MESSAGE("Downshift " << vector_to_string(va) << " by " << j);
+
+                assert(va.size() == (i + 8) / 8);
+                Val64 v64a(va);
+                Val64::op_downshift(v64a, val64_singleton(j), varcost);
+                va = v64a.move_to_valtype();
+
+                std::vector<unsigned char> expected;
+                if (j <= i)
+                    expected = vec_setbit(i - j);
+
+                // Definitionally, downshift only removes one byte for every 8 bits shifted.
+                if (j / 8 <= (i + 8) / 8)
+                    expected.resize((i + 8) / 8 - j / 8);
+
+                BOOST_TEST_MESSAGE("Got " << vector_to_string(va) << " expected " << vector_to_string(expected));
+
+                CHECK(va == expected);
+            }
+        }
+
+
+#ifdef USE_GMP
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = InsecureRandRange(500);
+            size_t sbits = InsecureRandRange(500 * 8);
+
+            std::vector<unsigned char> v1 =    g_insecure_rand_ctx.randbytes(len1);
+
+            BOOST_TEST_MESSAGE("Right shifting " << vector_to_string(v1) << " by " << sbits);
+
+            // GMP version
+            mpz_t mpz1, mpz_result;
+            vector_to_mpz(v1, mpz1);
+            mpz_init(mpz_result);
+            mpz_fdiv_q_2exp(mpz_result, mpz1, sbits);
+
+            // We subtract only whole bytes from length.
+            std::vector<uint8_t> expect = mpz_to_vector(mpz_result, v1.size() > sbits / 8 ? v1.size() - sbits / 8 : 0);
+            mpz_clears(mpz1, mpz_result, NULL);
+
+            // Val64 version
+            Val64 v64(v1);
+            Val64::op_downshift(v64, val64_singleton(sbits), varcost);
+            v1 = v64.move_to_valtype();
+
+            CHECK(v1 == expect);
+        }
+#endif
+    }
+    Val64Test::set_suppress_alignment_warnings(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_add_span)
+{
+    Val64Test res(std::vector<unsigned char>(sizeof(uint64_t) * 2));
+
+    // 0xFFFFFFFFFFFFFFFF
+    const Val64Test u64_max(std::vector<unsigned char>(sizeof(uint64_t), 0xff));
+    const Val64Test u64_zero(std::vector<unsigned char>(sizeof(uint64_t), 0));
+    bool carry;
+    size_t nonzero_len;
+
+    // Add empty at offset 0.
+    carry = Val64Test::add_span(res.span(), u64_zero.span(), nonzero_len);
+    assert(res.get(0) == 0);
+    assert(res.get(1) == 0);
+    assert(nonzero_len == 0);
+    assert(!carry);
+
+    // Add at offset 0.
+    carry = Val64Test::add_span(res.span(), u64_max.span(), nonzero_len);
+    assert(res.get(0) == 0xFFFFFFFFFFFFFFFFULL);
+    assert(res.get(1) == 0);
+    assert(nonzero_len == 1);
+    assert(!carry);
+
+    // Add at offset 1.
+    carry = Val64Test::add_span(res.span().subspan(1), u64_max.span(), nonzero_len);
+    assert(res.get(0) == 0xFFFFFFFFFFFFFFFFULL);
+    assert(res.get(1) == 0xFFFFFFFFFFFFFFFFULL);
+    // Relative to subspan!
+    assert(nonzero_len == 1);
+    assert(!carry);
+
+    // Add one more, should carry.
+    carry = Val64Test::add_span(res.span().subspan(1), Val64Test(1).span(), nonzero_len);
+    assert(res.get(0) == 0xFFFFFFFFFFFFFFFFULL);
+    assert(res.get(1) == 0);
+    assert(carry);
+}
+
+BOOST_AUTO_TEST_CASE(val64_sub_span)
+{
+    Val64Test res(std::vector<unsigned char>(sizeof(uint64_t) * 2, 0xFF));
+
+    // 0xFFFFFFFFFFFFFFFF
+    const Val64Test u64_max(std::vector<unsigned char>(sizeof(uint64_t), 0xff));
+    const Val64Test u64_zero(std::vector<unsigned char>(sizeof(uint64_t), 0));
+    bool underflow;
+    size_t nonzero_len;
+
+    // Sub empty at offset 0.
+    underflow = Val64Test::sub_span(res.span(), u64_zero.span(),
+                                    nonzero_len);
+    assert(res.get(0) == 0xFFFFFFFFFFFFFFFFULL);
+    assert(res.get(1) == 0xFFFFFFFFFFFFFFFFULL);
+    assert(nonzero_len == 2);
+    assert(!underflow);
+
+    // Sub at offset 1.
+    underflow = Val64Test::sub_span(res.span().subspan(1), u64_max.span(),
+                                    nonzero_len);
+    assert(res.get(0) == 0xFFFFFFFFFFFFFFFFULL);
+    assert(res.get(1) == 0);
+    assert(nonzero_len == 0);
+    assert(!underflow);
+
+    // Sub at offset 0.
+    underflow = Val64Test::sub_span(res.span(), u64_max.span(), nonzero_len);
+    assert(res.get(0) == 0);
+    assert(res.get(1) == 0);
+    assert(nonzero_len == 0);
+    assert(!underflow);
+
+    // Sub one more, should underflow.
+    underflow = Val64Test::sub_span(res.span().subspan(1), Val64Test(1).span(),
+                                    nonzero_len);
+    assert(res.get(0) == 0);
+    assert(res.get(1) == 0xFFFFFFFFFFFFFFFFULL);
+    assert(underflow);
+}
+
+BOOST_AUTO_TEST_CASE(val64_mul_span)
+{
+    Val64Test::set_force_unaligned(false);
+
+    for (bool portable_math : {false, true}) {
+        Val64Test::set_force_portable_math(portable_math);
+
+    // Multiply this by mul, place into res.
+    for (size_t i = 0; i < 128; i++) {
+        for (size_t j = 0; j < 65; j++) {
+            Val64Test v64a(vec_setbit(i));
+
+            // Initial contents shouldn't matter, but size needs to match.
+            size_t vecsize = (v64a.u64_size() + 1) * sizeof(uint64_t);
+            std::vector<unsigned char> dummy(vecsize, 1|j);
+            Val64Test res64(dummy);
+
+            if (j == 64) {
+                // Test multiply by 0
+                Val64Test::mul_span(res64.span(), v64a.span(), 0);
+            } else {
+                Val64Test::mul_span(res64.span(), v64a.span(), (uint64_t)1 << j);
+            }
+
+            // mul_vector does not trim zeros.
+            std::vector<unsigned char> expected(vecsize);
+            if (j != 64)
+                expected = vec_setbit(i + j, expected);
+            CHECK(res64.move_to_valtype() == expected);
+        }
+    }
+
+    } // end for portable_math
+    Val64Test::set_force_portable_math(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_mul)
+{
+    // FIXME: Test varcosts!
+    size_t varcost = 0;
+    for (bool portable_math : {false, true}) {
+        Val64Test::set_force_portable_math(portable_math);
+    for (bool unaligned: {false, true}) {
+        Val64Test::set_force_unaligned(unaligned);
+
+        for (size_t i = 0; i < 128; i++) {
+            for (size_t j = 0; j < 129; j++) {
+                std::vector<unsigned char> va = vec_setbit(i), vb;
+
+                if (j != 129) // Test multiply by 0!
+                    vb = vec_setbit(j);
+                BOOST_TEST_MESSAGE("Multiply " << vector_to_string(va) << " by " << vector_to_string(vb));
+
+                Val64 v64a(va);
+                Val64 v64b(vb);
+                Val64 ret = Val64::op_mul(v64a, v64b);
+                auto retvec = ret.move_to_valtype();
+
+                std::vector<unsigned char> expected;
+                if (j != 129)
+                    expected = vec_setbit(i + j);
+
+                BOOST_TEST_MESSAGE("Got " << vector_to_string(retvec) << " expected " << vector_to_string(expected));
+
+                CHECK(retvec == expected);
+            }
+        }
+
+        // Also easy to test N-1.
+        for (size_t i = 1; i < 128; i++) {
+            for (size_t j = 0; j < 128; j++) {
+                std::vector<unsigned char> va, vb;
+
+                for (size_t n = 0; n < i; n++)
+                    va = vec_setbit(n, va);
+                vb = vec_setbit(j);
+                BOOST_TEST_MESSAGE("Multiply " << vector_to_string(va) << " by " << vector_to_string(vb));
+
+                Val64 v64a(va);
+                Val64 v64b(vb);
+                Val64 ret = Val64::op_mul(v64a, v64b);
+                auto retvec = ret.move_to_valtype();
+
+                // Subtract 1 j.
+                Val64Test expected64(vec_setbit(i + j));
+                Val64Test single(vec_setbit(j));
+                bool ok = Val64::op_sub(expected64, single, varcost);
+                assert(ok);
+                std::vector<unsigned char> expected = expected64.move_to_valtype();
+
+                BOOST_TEST_MESSAGE("Got " << vector_to_string(retvec) << " expected " << vector_to_string(expected));
+
+                CHECK(retvec == expected);
+            }
+        }
+
+#ifdef USE_GMP
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = InsecureRandRange(50);
+            size_t len2 = InsecureRandRange(50);
+
+            std::vector<unsigned char> v1 =    g_insecure_rand_ctx.randbytes(len1);
+            std::vector<unsigned char> v2 =    g_insecure_rand_ctx.randbytes(len2);
+
+            BOOST_TEST_MESSAGE("Multiplying " << vector_to_string(v1) << " by " << vector_to_string(v2));
+
+            // GMP version
+            mpz_t mpz1, mpz2, mpz_result;
+            vector_to_mpz(v1, mpz1);
+            vector_to_mpz(v2, mpz2);
+            mpz_init(mpz_result);
+            mpz_mul(mpz_result, mpz1, mpz2);
+
+            std::vector<uint8_t> expect = mpz_to_vector(mpz_result);
+            mpz_clears(mpz1, mpz2, mpz_result, NULL);
+
+            // Val64 version
+            Val64 v64a(v1);
+            Val64 v64b(v2);
+            Val64 ret64 = Val64::op_mul(v64a, v64b);
+            std::vector<uint8_t> ret = ret64.move_to_valtype();
+
+            CHECK(ret == expect);
+        }
+#endif
+    }
+    } // end for portable_math
+    Val64Test::set_force_portable_math(false);
+    Val64Test::set_suppress_alignment_warnings(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_2mul)
+{
+    // FIXME: Test varcosts!
+    size_t varcost = 0;
+    for (bool unaligned: {false, true}) {
+        Val64Test::set_force_unaligned(unaligned);
+
+        for (size_t i = 0; i < 129; i++) {
+            for (size_t j = 0; j < 16; j++) {
+                std::vector<unsigned char> va;
+
+                // Test zero case
+                if (i != 128)
+                    va = vec_setbit(i);
+
+                // Append empty bytes (shouldn't make a difference)
+                va.insert(va.end(), j, 0);
+                BOOST_TEST_MESSAGE("2mul " << vector_to_string(va));
+
+                Val64 v64a(va);
+                Val64::op_2mul(v64a, varcost);
+                va = v64a.move_to_valtype();
+
+                std::vector<unsigned char> expected;
+
+                if (i != 128)
+                    expected = vec_setbit(i + 1);
+
+                BOOST_TEST_MESSAGE("Got " << vector_to_string(va) << " expected " << vector_to_string(expected));
+
+                CHECK(va == expected);
+            }
+        }
+
+
+#ifdef USE_GMP
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = InsecureRandRange(500);
+            std::vector<unsigned char> v1 =    g_insecure_rand_ctx.randbytes(len1);
+
+            BOOST_TEST_MESSAGE("2mul " << vector_to_string(v1));
+
+            // GMP version
+            mpz_t mpz1, mpz_result;
+            vector_to_mpz(v1, mpz1);
+            mpz_init(mpz_result);
+            mpz_mul_2exp(mpz_result, mpz1, 1);
+
+            std::vector<uint8_t> expect = mpz_to_vector(mpz_result);
+            mpz_clears(mpz1, mpz_result, NULL);
+
+            // Val64 version
+            Val64 v64(v1);
+            Val64::op_2mul(v64, varcost);
+            v1 = v64.move_to_valtype();
+
+            CHECK(v1 == expect);
+        }
+#endif
+    }
+    Val64Test::set_suppress_alignment_warnings(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_2div)
+{
+    // FIXME: Test varcosts!
+    size_t varcost = 0;
+    for (bool unaligned: {false, true}) {
+        Val64Test::set_force_unaligned(unaligned);
+
+        for (size_t i = 0; i < 129; i++) {
+            for (size_t j = 0; j < 16; j++) {
+                std::vector<unsigned char> va;
+
+                // Test zero case
+                if (i != 128)
+                    va = vec_setbit(i);
+
+                // Append empty bytes (shouldn't make a difference)
+                va.insert(va.end(), j, 0);
+
+                BOOST_TEST_MESSAGE("2div " << vector_to_string(va));
+                Val64 v64a(va);
+                Val64::op_2div(v64a, varcost);
+                va = v64a.move_to_valtype();
+
+                std::vector<unsigned char> expected;
+                if (i > 0 && i != 128)
+                    expected = vec_setbit(i - 1);
+
+                BOOST_TEST_MESSAGE("Got " << vector_to_string(va) << " expected " << vector_to_string(expected));
+
+                CHECK(va == expected);
+            }
+        }
+
+
+#ifdef USE_GMP
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = InsecureRandRange(500);
+            std::vector<unsigned char> v1 =    g_insecure_rand_ctx.randbytes(len1);
+
+            BOOST_TEST_MESSAGE("2mul " << vector_to_string(v1));
+
+            // GMP version
+            mpz_t mpz1, mpz_result;
+            vector_to_mpz(v1, mpz1);
+            mpz_init(mpz_result);
+            mpz_fdiv_q_2exp(mpz_result, mpz1, 1);
+
+            std::vector<uint8_t> expect = mpz_to_vector(mpz_result);
+            mpz_clears(mpz1, mpz_result, NULL);
+
+            // Val64 version
+            Val64 v64(v1);
+            Val64::op_2div(v64, varcost);
+            v1 = v64.move_to_valtype();
+
+            CHECK(v1 == expect);
+        }
+#endif
+    }
+    Val64Test::set_suppress_alignment_warnings(false);
+}
+
+BOOST_AUTO_TEST_CASE(val64_div_mod)
+{
+    for (bool portable_math : {false, true}) {
+        Val64Test::set_force_portable_math(portable_math);
+    for (bool unaligned: {false, true}) {
+        Val64Test::set_force_unaligned(unaligned);
+
+        for (size_t i = 0; i < 128; i++) {
+            for (size_t j = 0; j < 129; j++) {
+                std::vector<unsigned char> va = vec_setbit(i), vb;
+
+                if (j != 129) // Test divide by 0!
+                    vb = vec_setbit(j);
+                BOOST_TEST_MESSAGE("Divide " << vector_to_string(va) << " by " << vector_to_string(vb));
+
+                Val64Test v64a_div(va), v64a_mod(va);
+                Val64Test v64b_div(vb), v64b_mod(vb);
+                bool div_ret = Val64Test::op_div(v64a_div, v64b_div);
+                bool mod_ret = Val64Test::op_mod(v64a_mod, v64b_mod);
+                auto div_vec = v64a_div.move_to_valtype();
+                auto mod_vec = v64a_mod.move_to_valtype();
+
+                std::vector<unsigned char> expected_div, expected_remainder;
+                if (j == 129) {
+                    CHECK(div_ret == false);
+                    CHECK(mod_ret == false);
+                } else {
+                    CHECK(div_ret == true);
+                    CHECK(mod_ret == true);
+                    if (i >= j)
+                        expected_div = vec_setbit(i - j);
+                    else
+                        expected_remainder = vec_setbit(i);
+
+                    BOOST_TEST_MESSAGE("Got " << vector_to_string(div_vec) << "/" << vector_to_string(mod_vec) << " expected " << vector_to_string(expected_div) << "/" << vector_to_string(expected_remainder));
+
+                    CHECK(div_vec == expected_div);
+                    CHECK(mod_vec == expected_remainder);
+                }
+            }
+        }
+
+#ifdef USE_GMP
+        for (size_t i = 0; i < 1000; i++) {
+            size_t len1 = InsecureRandRange(50);
+            size_t len2 = InsecureRandRange(50);
+
+            std::vector<unsigned char> v1 =    g_insecure_rand_ctx.randbytes(len1);
+            std::vector<unsigned char> v2 =    g_insecure_rand_ctx.randbytes(len2);
+
+            BOOST_TEST_MESSAGE("Dividing " << vector_to_string(v1) << " by " << vector_to_string(v2));
+
+            // GMP version
+            mpz_t mpz1, mpz2, mpz_result, mpz_remainder;
+            bool expect_success;
+            vector_to_mpz(v1, mpz1);
+            vector_to_mpz(v2, mpz2);
+            mpz_init(mpz_result);
+            mpz_init(mpz_remainder);
+            if (mpz_sgn(mpz2) == 0) {
+                expect_success = false;
+            } else {
+                mpz_fdiv_qr(mpz_result, mpz_remainder, mpz1, mpz2);
+                expect_success = true;
+            }
+            std::vector<uint8_t> expect_res = mpz_to_vector(mpz_result);
+            std::vector<uint8_t> expect_rem = mpz_to_vector(mpz_remainder);
+            mpz_clears(mpz1, mpz2, mpz_result, mpz_remainder, NULL);
+
+            // Val64 version
+            Val64Test v64a_div(v1), v64a_mod(v1);
+            Val64Test v64b_div(v2), v64b_mod(v2);
+            bool div_ret = Val64Test::op_div(v64a_div, v64b_div);
+            bool mod_ret = Val64Test::op_mod(v64a_mod, v64b_mod);
+            auto div_vec = v64a_div.move_to_valtype();
+            auto mod_vec = v64a_mod.move_to_valtype();
+
+            CHECK(div_ret == expect_success);
+            CHECK(mod_ret == expect_success);
+            if (expect_success) {
+                CHECK(div_vec == expect_res);
+                CHECK(mod_vec == expect_rem);
+            }
+        }
+#endif
+    }
+    } // end for portable_math
+    Val64Test::set_force_portable_math(false);
+    Val64Test::set_suppress_alignment_warnings(false);
+}
+
+// Test edge cases for the portable 64-bit math implementation (used on Windows/MSVC).
+// These tests specifically target edge cases that could trigger overflow bugs in
+// the 128-bit arithmetic emulation.
+BOOST_AUTO_TEST_CASE(val64_portable_math_edge_cases)
+{
+    Val64Test::set_suppress_alignment_warnings(true);
+
+    for (bool portable_math : {false, true}) {
+        Val64Test::set_force_portable_math(portable_math);
+        BOOST_TEST_MESSAGE("Testing with force_portable_math=" << portable_math);
+
+    // Test multiplication edge case: (2^64-1) * (2^64-1)
+    // This tests the mul_span portable implementation
+    {
+        std::vector<unsigned char> max_u64(8, 0xFF);
+        Val64Test v64a(max_u64);
+        Val64Test v64b(max_u64);
+        Val64 ret = Val64::op_mul(v64a, v64b);
+        auto retvec = ret.move_to_valtype();
+
+        // (2^64-1)^2 = 2^128 - 2^65 + 1
+        // In little-endian bytes: 0x01, 0x00, ..., 0x00, 0xFE, 0xFF, ..., 0xFF
+        std::vector<unsigned char> expected = {
+            0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  // low word
+            0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF   // high word
+        };
+        CHECK(retvec == expected);
+    }
+
+    // Test division edge case that exercises the Knuth refinement loop
+    // We need a dividend and divisor that produce a large qstar estimate
+    // and where v2[n-2] is also large, triggering the cross overflow.
+    {
+        // Dividend: a large number with multiple 64-bit words
+        // 0xFFFFFFFFFFFFFFFF_FFFFFFFFFFFFFFFF (two words of all 1s)
+        std::vector<unsigned char> dividend(16, 0xFF);
+
+        // Divisor: 0x8000000000000001 (normalized, with second word considerations)
+        // This divisor has the top bit set (normalized) and will produce
+        // a quotient estimate that exercises the refinement.
+        std::vector<unsigned char> divisor = {
+            0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80
+        };
+
+        Val64Test v64a_div(dividend);
+        Val64Test v64b_div(divisor);
+        bool div_ret = Val64Test::op_div(v64a_div, v64b_div);
+        CHECK(div_ret == true);
+
+        auto div_vec = v64a_div.move_to_valtype();
+        std::vector<unsigned char> expected_div = {
+            0xFC, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x01
+        };
+        CHECK(div_vec == expected_div);
+    }
+
+    // Test another division edge case: dividend that produces qstar close to 2^64
+    {
+        std::vector<unsigned char> dividend = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+        };
+        std::vector<unsigned char> divisor(8, 0xFF);
+
+        Val64Test v64a_div(dividend);
+        Val64Test v64b_div(divisor);
+        bool div_ret = Val64Test::op_div(v64a_div, v64b_div);
+        CHECK(div_ret == true);
+
+        auto div_vec = v64a_div.move_to_valtype();
+        std::vector<unsigned char> expected_div(8, 0xFF);
+        expected_div[0] = 0xFE;
+        CHECK(div_vec == expected_div);
+    }
+
+    // Test mod with the same edge case
+    {
+        std::vector<unsigned char> dividend = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+        };
+        std::vector<unsigned char> divisor(8, 0xFF);
+
+        Val64Test v64a_mod(dividend);
+        Val64Test v64b_mod(divisor);
+        bool mod_ret = Val64Test::op_mod(v64a_mod, v64b_mod);
+        CHECK(mod_ret == true);
+
+        auto mod_vec = v64a_mod.move_to_valtype();
+        std::vector<unsigned char> expected_mod = {
+            0xFE, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+        };
+        CHECK(mod_vec == expected_mod);
+    }
+
+    // Test case specifically designed to trigger cross overflow in Knuth refinement.
+    // We need: qstar close to 2^64 and v2[n-2] close to 2^64.
+    // This happens when the dividend's top two words form a value just under
+    // (divisor[n-1] * 2^64), and divisor[n-2] is large.
+    {
+        // Create a 3-word dividend and 2-word divisor to exercise the refinement.
+        // Dividend: 0x7FFFFFFFFFFFFFFF_FFFFFFFFFFFFFFFF_FFFFFFFFFFFFFFFF
+        std::vector<unsigned char> dividend = {
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x7F
+        };
+
+        // Divisor: 0x8000000000000000_FFFFFFFFFFFFFFFF
+        // This has a normalized high word and a large second word.
+        std::vector<unsigned char> divisor = {
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80
+        };
+
+        Val64Test v64a_div(dividend);
+        Val64Test v64b_div(divisor);
+        bool div_ret = Val64Test::op_div(v64a_div, v64b_div);
+        CHECK(div_ret == true);
+
+        // Verify by multiplying back: quotient * divisor + remainder = dividend
+        // For this test, we just verify the operation completes without error.
+        // A more thorough check would use GMP (which is done in the random tests above).
+    }
+
+    }
+
+    Val64Test::set_force_portable_math(false);
+    Val64Test::set_suppress_alignment_warnings(false);
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/valtype_stack_tests.cpp b/src/test/valtype_stack_tests.cpp
new file mode 100644
index 000000000000..032ec2c06121
--- /dev/null
+++ b/src/test/valtype_stack_tests.cpp
@@ -0,0 +1,228 @@
+// Copyright (c) 2024-present The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <common/system.h>
+#include <core_io.h>
+#include <key.h>
+#include <rpc/util.h>
+#include <script/script.h>
+#include <script/script_error.h>
+#include <script/sigcache.h>
+#include <script/sign.h>
+#include <script/signingprovider.h>
+#include <script/solver.h>
+#include <streams.h>
+#include <test/util/json.h>
+#include <test/util/random.h>
+#include <test/util/setup_common.h>
+#include <test/util/transaction_utils.h>
+#include <tinyformat.h>
+#include <util/fs.h>
+#include <util/strencodings.h>
+#include <script/valtype_stack.h>
+
+#include <chrono>
+#include <cstdint>
+#include <fstream>
+#include <string>
+#include <vector>
+
+#include <boost/test/unit_test.hpp>
+
+#include <univalue.h>
+#include <script/val64.h>
+
+using namespace util::hex_literals;
+
+struct ValtypeStackTest : BasicTestingSetup {
+};
+
+BOOST_FIXTURE_TEST_SUITE(valtype_stack_tests, ValtypeStackTest)
+
+BOOST_AUTO_TEST_CASE(valtype_stack_size_tracking)
+{
+    // Test ValtypeStack size tracking during Val64 operations
+
+    // Define stacktop macro like in interpreter.cpp
+    #define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
+
+    // Test 1: Basic size tracking with arithmetic operations
+    {
+        ValtypeStack stack;
+
+        // Add two 8-byte numbers
+        Val64 v1(0x123456789ABCDEF0ULL);
+        Val64 v2(0x1111111111111111ULL);
+
+        auto vec1 = v1.move_to_valtype();
+        auto vec2 = v2.move_to_valtype();
+
+        size_t initial_size1 = vec1.size();
+        size_t initial_size2 = vec2.size();
+
+        stack.push_back(vec1);
+        stack.push_back(vec2);
+
+        // Verify initial tracking
+        BOOST_CHECK_EQUAL(stack.get_total_size(), initial_size1 + initial_size2);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), std::max(initial_size1, initial_size2));
+
+        // Perform addition that modifies top element in place
+        BaseSignatureChecker checker;
+        ScriptExecutionData sdata;
+        ScriptError serror;
+        uint64_t varops_budget = 1000000;
+
+        CScript script;
+        script << OP_ADD;
+
+        BOOST_CHECK(EvalGsrScript(stack, script, 0, checker, SigVersion::TAPSCRIPT_V2, sdata, varops_budget, &serror));
+        BOOST_CHECK_EQUAL(serror, SCRIPT_ERR_OK);
+
+        BOOST_CHECK_EQUAL(stack.size(), 1);
+        size_t result_size = stacktop(-1).size();
+        BOOST_CHECK_EQUAL(stack.get_total_size(), result_size);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), result_size);
+    }
+
+    // Test 2: High water mark tracking (max element size never decreases)
+    {
+        ValtypeStack stack;
+
+        // Add elements of different sizes
+        std::vector<unsigned char> small_elem(10, 0x42);  // 10 bytes
+        std::vector<unsigned char> medium_elem(50, 0x43); // 50 bytes
+        std::vector<unsigned char> large_elem(100, 0x44); // 100 bytes
+
+        stack.push_back(small_elem);
+        stack.push_back(medium_elem);
+        stack.push_back(large_elem);
+
+        BOOST_CHECK_EQUAL(stack.get_total_size(), 160);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), 100);
+
+        // Remove the largest element - max should still be 100 (high water mark)
+        stack.pop_back();
+        BOOST_CHECK_EQUAL(stack.get_total_size(), 60);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), 100);
+
+        // Remove medium element
+        stack.pop_back();
+        BOOST_CHECK_EQUAL(stack.get_total_size(), 10);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), 100);
+    }
+
+    // Test 3: Mixed operations (insert, erase, clear)
+    {
+        ValtypeStack stack;
+
+        // Add elements of various sizes
+        for (size_t i = 1; i <= 3; i++) {
+            std::vector<unsigned char> elem(i * 10, static_cast<unsigned char>(0x40 + i));
+            stack.push_back(elem);
+        }
+
+        BOOST_CHECK_EQUAL(stack.get_total_size(), 60);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), 30);
+
+        // Erase middle element
+        stack.erase(1);
+        BOOST_CHECK_EQUAL(stack.get_total_size(), 40);
+
+        // Insert larger element
+        std::vector<unsigned char> new_elem(50, 0x99);
+        stack.insert(1, new_elem);
+        BOOST_CHECK_EQUAL(stack.get_total_size(), 90);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), 50);
+
+        // Clear and verify
+        stack.clear();
+        BOOST_CHECK_EQUAL(stack.get_total_size(), 0);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), 0);
+    }
+
+    // Test 4: OP_CAT operation with size tracking
+    {
+        ValtypeStack stack;
+        stack.push_back({'a', 'b', 'c'});
+        stack.push_back({'d', 'e', 'f'});
+
+        BOOST_CHECK_EQUAL(stack.get_total_size(), 6);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), 3);
+
+        CScript script;
+        script << OP_CAT;
+
+        BaseSignatureChecker checker;
+        ScriptExecutionData sdata;
+        ScriptError serror;
+        uint64_t varops_budget = 1000000;
+
+        BOOST_CHECK(EvalGsrScript(stack, script, 0, checker, SigVersion::TAPSCRIPT_V2, sdata, varops_budget, &serror));
+        BOOST_CHECK_EQUAL(serror, SCRIPT_ERR_OK);
+        BOOST_CHECK_EQUAL(stack.size(), 1);
+
+        BOOST_CHECK_EQUAL(stack.get_total_size(), 6);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), 6);
+    }
+
+    // Test 5: Copy operations preserve size tracking
+    {
+        ValtypeStack original;
+
+        // Fill with various sized elements
+        std::vector<unsigned char> small(25, 0x11);
+        std::vector<unsigned char> medium(75, 0x22);
+        std::vector<unsigned char> large(125, 0x33);
+
+        original.push_back(small);
+        original.push_back(medium);
+        original.push_back(large);
+
+        BOOST_CHECK_EQUAL(original.get_max_element_size(), 125);
+        BOOST_CHECK_EQUAL(original.get_total_size(), 225);
+
+        // Test copy constructor
+        ValtypeStack copied(original);
+        BOOST_CHECK_EQUAL(copied.get_max_element_size(), 125);
+        BOOST_CHECK_EQUAL(copied.get_total_size(), 225);
+
+        // Test copy assignment
+        ValtypeStack assigned;
+        assigned = original;
+        BOOST_CHECK_EQUAL(assigned.get_max_element_size(), 125);
+        BOOST_CHECK_EQUAL(assigned.get_total_size(), 225);
+    }
+
+    // Test 6: Edge cases (empty elements and empty stack)
+    {
+        ValtypeStack stack;
+
+        // Add empty elements and non-empty elements
+        std::vector<unsigned char> empty_elem;           // 0 bytes
+        std::vector<unsigned char> small_elem(1, 0x42);  // 1 byte
+        std::vector<unsigned char> large_elem(50, 0x43); // 50 bytes
+
+        stack.push_back(empty_elem);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), 0);
+
+        stack.push_back(small_elem);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), 1);
+
+        stack.push_back(large_elem);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), 50);
+
+        // Add another empty element
+        stack.push_back(empty_elem);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), 50);
+
+        // Remove large element - high water mark stays
+        stack.erase(2);
+        BOOST_CHECK_EQUAL(stack.get_max_element_size(), 50);
+    }
+
+    #undef stacktop
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/validation.cpp b/src/validation.cpp
index f40096066d91..cfbb194847ef 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -2129,7 +2129,7 @@ std::optional<std::pair<ScriptError, std::string>> CScriptCheck::operator()() {
     const CScript &scriptSig = ptxTo->vin[nIn].scriptSig;
     const CScriptWitness *witness = &ptxTo->vin[nIn].scriptWitness;
     ScriptError error{SCRIPT_ERR_UNKNOWN_ERROR};
-    if (VerifyScript(scriptSig, m_tx_out.scriptPubKey, witness, m_flags, CachingTransactionSignatureChecker(ptxTo, nIn, m_tx_out.nValue, cacheStore, *m_signature_cache, *txdata), &error)) {
+    if (VerifyScript(scriptSig, m_tx_out.scriptPubKey, witness, m_flags, CachingTransactionSignatureChecker(ptxTo, nIn, m_tx_out.nValue, cacheStore, *m_signature_cache, *txdata), &error, varops_budget)) {
         return std::nullopt;
     } else {
         auto debug_str = strprintf("input %i of %s (wtxid %s), spending %s:%i", nIn, ptxTo->GetHash().ToString(), ptxTo->GetWitnessHash().ToString(), ptxTo->vin[nIn].prevout.hash.ToString(), ptxTo->vin[nIn].prevout.n);
diff --git a/src/validation.h b/src/validation.h
index e04d340660f5..06122a6c6532 100644
--- a/src/validation.h
+++ b/src/validation.h
@@ -338,10 +338,13 @@ class CScriptCheck
     bool cacheStore;
     PrecomputedTransactionData *txdata;
     SignatureCache* m_signature_cache;
+    std::optional<uint64_t> varops_budget;
 
 public:
     CScriptCheck(const CTxOut& outIn, const CTransaction& txToIn, SignatureCache& signature_cache, unsigned int nInIn, script_verify_flags flags, bool cacheIn, PrecomputedTransactionData* txdataIn) :
-        m_tx_out(outIn), ptxTo(&txToIn), nIn(nInIn), m_flags(flags), cacheStore(cacheIn), txdata(txdataIn), m_signature_cache(&signature_cache) { }
+        m_tx_out(outIn), ptxTo(&txToIn), nIn(nInIn), m_flags(flags), cacheStore(cacheIn), txdata(txdataIn), m_signature_cache(&signature_cache) {
+            varops_budget = static_cast<uint64_t>(GetTransactionWeight(*ptxTo)) * VAROPS_BUDGET_PER_BYTE;
+        }
 
     CScriptCheck(const CScriptCheck&) = delete;
     CScriptCheck& operator=(const CScriptCheck&) = delete;
diff --git a/src/wallet/feebumper.h b/src/wallet/feebumper.h
index d3d43861efcb..d27fc09c9a76 100644
--- a/src/wallet/feebumper.h
+++ b/src/wallet/feebumper.h
@@ -92,6 +92,7 @@ struct SignatureWeights
             break;
         case SigVersion::TAPROOT:
         case SigVersion::TAPSCRIPT:
+        case SigVersion::TAPSCRIPT_V2:
             assert(false);
         }
     }
diff --git a/test/config.ini b/test/config.ini
new file mode 100644
index 000000000000..db71afffefd4
--- /dev/null
+++ b/test/config.ini
@@ -0,0 +1,27 @@
+# Copyright (c) 2013-2016 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+# These environment variables are set by the build process and read by
+# test/*/test_runner.py and test/util/rpcauth-test.py
+
+[environment]
+CLIENT_NAME=Bitcoin Core
+CLIENT_BUGREPORT=https://github.com/bitcoin/bitcoin/issues
+SRCDIR=/Users/julian/Code/bitcoin/inquisitionGsr
+BUILDDIR=/Users/julian/Code/bitcoin/inquisitionGsr/build
+EXEEXT=
+RPCAUTH=/Users/julian/Code/bitcoin/inquisitionGsr/share/rpcauth/rpcauth.py
+
+[components]
+# Which components are enabled. These are commented out by `configure` if they were disabled when running config.
+ENABLE_WALLET=true
+USE_BDB=true
+ENABLE_CLI=true
+ENABLE_BITCOIN_UTIL=true
+ENABLE_WALLET_TOOL=true
+ENABLE_BITCOIND=true
+#ENABLE_FUZZ_BINARY=true
+ENABLE_ZMQ=true
+ENABLE_EXTERNAL_SIGNER=true
+#ENABLE_USDT_TRACEPOINTS=true
diff --git a/test/functional/feature_taproot.py b/test/functional/feature_taproot.py
index 693cbd69d81f..69d02f5c254a 100755
--- a/test/functional/feature_taproot.py
+++ b/test/functional/feature_taproot.py
@@ -33,6 +33,7 @@
     CScriptOp,
     hash256,
     LEAF_VERSION_TAPSCRIPT,
+    LEAF_VERSION_TAPSCRIPT_V2,
     LegacySignatureMsg,
     LOCKTIME_THRESHOLD,
     MAX_SCRIPT_ELEMENT_SIZE,
@@ -1174,8 +1175,8 @@ def predict_sigops_ratio(n, dummy_size):
 
     # Future leaf versions
     for leafver in range(0, 0x100, 2):
-        if leafver == LEAF_VERSION_TAPSCRIPT or leafver == ANNEX_TAG:
-            # Skip the defined LEAF_VERSION_TAPSCRIPT, and the ANNEX_TAG which is not usable as leaf version
+        if leafver == LEAF_VERSION_TAPSCRIPT or leafver == LEAF_VERSION_TAPSCRIPT_V2 or leafver == ANNEX_TAG:
+            # Skip the defined LEAF_VERSION_TAPSCRIPT, LEAF_VERSION_TAPSCRIPT_V2, and the ANNEX_TAG which is not usable as leaf version
             continue
         scripts = [
             ("bare_c0", CScript([OP_NOP])),
@@ -1284,7 +1285,7 @@ def spenders_taproot_nonstandard():
     sec = generate_privkey()
     pub, _ = compute_xonly_pubkey(sec)
     scripts = [
-        ("future_leaf", CScript([pub, OP_CHECKSIG]), 0xc2),
+        ("future_leaf", CScript([pub, OP_CHECKSIG]), 0xc4),
         ("op_success", CScript([pub, OP_CHECKSIG, OP_0, OP_IF, CScriptOp(0x50), OP_ENDIF])),
     ]
     tap = taproot_construct(pub, scripts)
diff --git a/test/functional/feature_tapscript_v2.py b/test/functional/feature_tapscript_v2.py
new file mode 100755
index 000000000000..0b9481ce9e65
--- /dev/null
+++ b/test/functional/feature_tapscript_v2.py
@@ -0,0 +1,1473 @@
+#!/usr/bin/env python3
+# Copyright (c) 2025 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+
+from test_framework.blocktools import (
+    COINBASE_MATURITY,
+)
+from test_framework.messages import (
+    COutPoint,
+    CTransaction,
+    CTxIn,
+    CTxInWitness,
+    CTxOut,
+    SEQUENCE_FINAL,
+)
+import hashlib
+from test_framework.script import (
+    CScript,
+    OP_1,
+    OP_2,
+    OP_3,
+    OP_EQUAL,
+    OP_NUMEQUAL,
+    OP_CHECKSIG,
+    OP_CHECKSIGADD,
+    OP_CAT,
+    OP_DUP,
+    OP_DROP,
+    OP_2DUP,
+    OP_2DROP,
+    OP_VERIFY,
+    OP_LESSTHAN,
+    OP_MUL,
+    OP_SHA256,
+    OP_CHECKLOCKTIMEVERIFY,
+)
+from test_framework.segwit_addr import encode_segwit_address
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.key import ECKey, compute_xonly_pubkey, sign_schnorr
+from test_framework.script import TaprootSignatureHash, taproot_construct, LEAF_VERSION_TAPSCRIPT_V2
+
+class TapscriptV2Test(BitcoinTestFramework):
+    def add_options(self, parser):
+        # Set default random seed for deterministic behavior
+        parser.set_defaults(randomseed=1234567890)
+        self.add_wallet_options(parser)
+
+    def skip_test_if_missing_module(self):
+        self.skip_if_no_wallet()
+
+    def set_test_params(self):
+        self.num_nodes = 1
+        self.setup_clean_chain = True
+
+    def print_test_status(self, test_name, is_start=True, success=None):
+        """Print colored test status messages.
+
+        Args:
+            test_name: Name of the test
+            is_start: True if starting test, False if ending
+            success: None for start, True/False for end status
+        """
+        # ANSI color codes
+        GREEN = '\033[92m'
+        RED = '\033[91m'
+        BLUE = '\033[94m'
+        RESET = '\033[0m'
+        BOLD = '\033[1m'
+
+        if is_start:
+            self.log.info(f"\n\n{BLUE}{BOLD}▶ Starting test:{RESET} {test_name}\n")
+        else:
+            if success:
+                self.log.info(f"\n\n{GREEN}{BOLD}✓ Test passed:{RESET} {test_name}\n")
+            else:
+                self.log.info(f"\n\n{RED}{BOLD}✗ Test failed:{RESET} {test_name}\n")
+
+    def test_simple_op1_script(self):
+        """Test 1: Simple OP_1 script (always true)"""
+        test_name = "Simple OP_1 script (always true)"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            locking_script = CScript([OP_1])
+            unlocking_script = []
+            result = self.test_simple_tapscript_v2_transaction(locking_script, unlocking_script)
+            self.print_test_status(test_name, is_start=False, success=result)
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_op_checksig_basic(self):
+        """Test 2: Basic OP_CHECKSIG with TAPSCRIPT_V2"""
+        test_name = "Basic OP_CHECKSIG with TAPSCRIPT_V2"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            key = ECKey()
+            key.generate()
+            pubkey_xonly, _ = compute_xonly_pubkey(key.get_bytes())
+
+            locking_script = CScript([pubkey_xonly, OP_CHECKSIG])  # Use x-only pubkey
+            utxo_info = self.create_tapscript_v2_funding_tx(locking_script, key.get_bytes(), amount=0.1)
+
+            spending_tx = self.create_tapscript_v2_spending_tx(utxo_info)
+
+            spent_output = CTxOut(int(utxo_info["amount"] * 100000000), utxo_info["tap"].scriptPubKey)
+
+            sighash = TaprootSignatureHash(
+                spending_tx,
+                [spent_output],
+                0,
+                0,  # hash_type (SIGHASH_DEFAULT)
+                scriptpath=True,
+                leaf_script=locking_script,
+                codeseparator_pos=-1,
+                leaf_ver=LEAF_VERSION_TAPSCRIPT_V2
+            )
+
+            signature = sign_schnorr(key.get_bytes(), sighash)
+            spending_tx.wit.vtxinwit[0].scriptWitness.stack.insert(0, signature)
+
+            result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+            if result['allowed']:
+                self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                self.generate(self.nodes[0], 1)
+                self.print_test_status(test_name, is_start=False, success=True)
+            else:
+                self.log.error(f"TAPSCRIPT_V2 OP_CHECKSIG transaction rejected: {result.get('reject-reason', 'Unknown')}")
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError(f"Transaction rejected: {result.get('reject-reason', 'Unknown')}")
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_multisig_2of2(self):
+        """Test: 2-of-2 multisig with OP_CHECKSIGADD"""
+        test_name = "2-of-2 multisig with OP_CHECKSIGADD"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            # Generate two keys
+            key1 = ECKey()
+            key1.generate()
+            pubkey1_xonly, _ = compute_xonly_pubkey(key1.get_bytes())
+
+            key2 = ECKey()
+            key2.generate()
+            pubkey2_xonly, _ = compute_xonly_pubkey(key2.get_bytes())
+
+            # 2-of-2 multisig: <pubkey1> OP_CHECKSIG <pubkey2> OP_CHECKSIGADD OP_2 OP_NUMEQUAL
+            locking_script = CScript([pubkey1_xonly, OP_CHECKSIG, pubkey2_xonly, OP_CHECKSIGADD, OP_2, OP_NUMEQUAL])
+
+            utxo_info = self.create_tapscript_v2_funding_tx(locking_script, amount=0.1)
+
+            # Create spending transaction without signatures first
+            spending_tx = self.create_tapscript_v2_spending_tx(utxo_info)
+            spent_output = CTxOut(int(utxo_info["amount"] * 100000000), utxo_info["tap"].scriptPubKey)
+
+            # Compute sighash
+            sighash = TaprootSignatureHash(
+                spending_tx,
+                [spent_output],
+                0,
+                0,
+                scriptpath=True,
+                leaf_script=locking_script,
+                codeseparator_pos=-1,
+                leaf_ver=LEAF_VERSION_TAPSCRIPT_V2
+            )
+
+            # Sign with both keys
+            sig1 = sign_schnorr(key1.get_bytes(), sighash)
+            sig2 = sign_schnorr(key2.get_bytes(), sighash)
+
+            # Insert signatures at the beginning of the witness stack
+            # Stack order: [sig2, sig1, script, control]
+            # During execution: sig1 is on top for first CHECKSIG, sig2 for CHECKSIGADD
+            spending_tx.wit.vtxinwit[0].scriptWitness.stack.insert(0, sig1)
+            spending_tx.wit.vtxinwit[0].scriptWitness.stack.insert(0, sig2)
+
+            result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+            if result['allowed']:
+                self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                self.generate(self.nodes[0], 1)
+                self.print_test_status(test_name, is_start=False, success=True)
+            else:
+                self.log.error(f"Transaction rejected: {result.get('reject-reason', 'Unknown')}")
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError(f"Transaction rejected: {result.get('reject-reason', 'Unknown')}")
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_keypath_spend(self):
+        """Test: Key path spending (no script revealed)"""
+        test_name = "Key path spending (most private)"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            from test_framework.key import tweak_add_privkey
+
+            # Generate internal key
+            internal_key = ECKey()
+            internal_key.generate()
+            internal_pubkey_xonly, _ = compute_xonly_pubkey(internal_key.get_bytes())
+
+            # Create a script tree (but we'll spend via key path, so scripts won't be revealed)
+            dummy_script = CScript([OP_1])
+
+            # Build taproot with script tree
+            tap = taproot_construct(internal_pubkey_xonly, [
+                ("dummy", dummy_script, LEAF_VERSION_TAPSCRIPT_V2)
+            ])
+
+            # Fund the taproot output
+            address = encode_segwit_address("bcrt", 1, tap.output_pubkey)
+            funding_txid = self.nodes[0].sendtoaddress(address, 0.1)
+            self.generate(self.nodes[0], 1)
+
+            funding_tx_info = self.nodes[0].gettransaction(funding_txid)
+            funding_tx_decoded = self.nodes[0].decoderawtransaction(funding_tx_info['hex'])
+
+            funding_vout = None
+            expected_scriptpubkey = f"5120{tap.output_pubkey.hex()}"
+            for i, vout in enumerate(funding_tx_decoded['vout']):
+                if vout['scriptPubKey']['hex'] == expected_scriptpubkey:
+                    funding_vout = i
+                    break
+
+            # Create spending transaction
+            spending_tx = CTransaction()
+            spending_tx.vin = [CTxIn(COutPoint(int(funding_txid, 16), funding_vout), b"", SEQUENCE_FINAL)]
+
+            output_address = self.nodes[0].getnewaddress()
+            output_script = bytes.fromhex(self.nodes[0].validateaddress(output_address)["scriptPubKey"])
+            output_amount = int(0.099 * 100000000)
+            spending_tx.vout = [CTxOut(output_amount, output_script)]
+
+            # Tweak the private key to get the key that controls the output
+            tweaked_privkey = tweak_add_privkey(internal_key.get_bytes(), tap.tweak)
+
+            # Compute sighash for key path (scriptpath=False)
+            spent_output = CTxOut(int(0.1 * 100000000), CScript([OP_1, tap.output_pubkey]))
+            sighash = TaprootSignatureHash(
+                spending_tx,
+                [spent_output],
+                0,
+                0,  # SIGHASH_DEFAULT
+                scriptpath=False  # KEY PATH, not script path
+            )
+
+            # Sign with the tweaked key
+            signature = sign_schnorr(tweaked_privkey, sighash)
+
+            # Key path witness is just the signature
+            spending_tx.wit.vtxinwit = [CTxInWitness()]
+            spending_tx.wit.vtxinwit[0].scriptWitness.stack = [signature]
+
+            result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+            if result['allowed']:
+                self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                self.generate(self.nodes[0], 1)
+                self.print_test_status(test_name, is_start=False, success=True)
+            else:
+                self.log.error(f"Transaction rejected: {result.get('reject-reason', 'Unknown')}")
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError(f"Transaction rejected: {result.get('reject-reason', 'Unknown')}")
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_multiple_leaves(self):
+        """Test: Taproot tree with multiple script leaves"""
+        test_name = "Multiple script leaves (merkle tree)"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            key = ECKey()
+            key.generate()
+            pubkey_xonly, _ = compute_xonly_pubkey(key.get_bytes())
+
+            # Create three different scripts
+            script_a = CScript([pubkey_xonly, OP_CHECKSIG])  # Simple checksig
+            script_b = CScript([OP_1])  # Always true
+            script_c = CScript([bytes([42]), OP_EQUAL])  # Check for specific value
+
+            # Build taproot with all three scripts
+            internal_key = hashlib.sha256(bytes([42])).digest()
+            pubkey_bytes, _ = compute_xonly_pubkey(internal_key)
+
+            tap = taproot_construct(pubkey_bytes, [
+                ("script_a", script_a, LEAF_VERSION_TAPSCRIPT_V2),
+                ("script_b", script_b, LEAF_VERSION_TAPSCRIPT_V2),
+                ("script_c", script_c, LEAF_VERSION_TAPSCRIPT_V2)
+            ])
+
+            address = encode_segwit_address("bcrt", 1, tap.output_pubkey)
+            funding_txid = self.nodes[0].sendtoaddress(address, 0.1)
+            self.generate(self.nodes[0], 1)
+
+            funding_tx_info = self.nodes[0].gettransaction(funding_txid)
+            funding_tx_decoded = self.nodes[0].decoderawtransaction(funding_tx_info['hex'])
+
+            funding_vout = None
+            expected_scriptpubkey = f"5120{tap.output_pubkey.hex()}"
+            for i, vout in enumerate(funding_tx_decoded['vout']):
+                if vout['scriptPubKey']['hex'] == expected_scriptpubkey:
+                    funding_vout = i
+                    break
+
+            # Spend using script_b (always true)
+            spending_tx = CTransaction()
+            spending_tx.vin = [CTxIn(COutPoint(int(funding_txid, 16), funding_vout), b"", SEQUENCE_FINAL)]
+
+            output_address = self.nodes[0].getnewaddress()
+            output_script = bytes.fromhex(self.nodes[0].validateaddress(output_address)["scriptPubKey"])
+            output_amount = int(0.099 * 100000000)
+            spending_tx.vout = [CTxOut(output_amount, output_script)]
+
+            # Use script_b
+            leaf_info = tap.leaves["script_b"]
+            control_block = bytes([leaf_info.version + tap.negflag]) + tap.internal_pubkey + leaf_info.merklebranch
+
+            spending_tx.wit.vtxinwit = [CTxInWitness()]
+            spending_tx.wit.vtxinwit[0].scriptWitness.stack = [script_b, control_block]
+
+            result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+            if result['allowed']:
+                self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                self.generate(self.nodes[0], 1)
+                self.print_test_status(test_name, is_start=False, success=True)
+            else:
+                self.log.error(f"Transaction rejected: {result.get('reject-reason', 'Unknown')}")
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError(f"Transaction rejected: {result.get('reject-reason', 'Unknown')}")
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_sighash_types(self):
+        """Test: All SIGHASH types"""
+        test_name = "All SIGHASH types (DEFAULT, ALL, NONE, SINGLE, ANYONECANPAY)"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            # Test cases: (hash_type, name, should_append_byte)
+            test_cases = [
+                (0x00, "SIGHASH_DEFAULT", False),
+                (0x01, "SIGHASH_ALL", True),
+                (0x02, "SIGHASH_NONE", True),
+                (0x03, "SIGHASH_SINGLE", True),
+                (0x81, "SIGHASH_ALL|ANYONECANPAY", True),
+                (0x82, "SIGHASH_NONE|ANYONECANPAY", True),
+                (0x83, "SIGHASH_SINGLE|ANYONECANPAY", True),
+            ]
+
+            passed = 0
+            failed = 0
+
+            for hash_type, name, append_byte in test_cases:
+                try:
+                    # Generate fresh key for each test
+                    key = ECKey()
+                    key.generate()
+                    pubkey_xonly, _ = compute_xonly_pubkey(key.get_bytes())
+
+                    locking_script = CScript([pubkey_xonly, OP_CHECKSIG])
+                    utxo_info = self.create_tapscript_v2_funding_tx(locking_script, key.get_bytes(), amount=0.1)
+
+                    # Create spending transaction
+                    spending_tx = self.create_tapscript_v2_spending_tx(utxo_info)
+                    spent_output = CTxOut(int(utxo_info["amount"] * 100000000), utxo_info["tap"].scriptPubKey)
+
+                    # For SIGHASH_SINGLE, we need to make sure there's an output at the same index
+                    # Since we only have 1 input (index 0) and 1 output (index 0), SINGLE should work
+
+                    # Compute sighash
+                    sighash = TaprootSignatureHash(
+                        spending_tx,
+                        [spent_output],
+                        hash_type,  # The hash type we're testing
+                        0,  # input_index = 0
+                        scriptpath=True,
+                        leaf_script=locking_script,
+                        codeseparator_pos=-1,
+                        leaf_ver=LEAF_VERSION_TAPSCRIPT_V2
+                    )
+
+                    # Create signature
+                    signature = sign_schnorr(key.get_bytes(), sighash)
+
+                    # Append hash type byte if needed (not for DEFAULT)
+                    if append_byte:
+                        signature += bytes([hash_type])
+
+                    # Insert signature at the beginning of witness stack
+                    # Stack before: [script, control]
+                    # Stack after: [signature, script, control]
+                    spending_tx.wit.vtxinwit[0].scriptWitness.stack.insert(0, signature)
+
+                    # Test transaction
+                    result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+                    if result['allowed']:
+                        self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                        self.generate(self.nodes[0], 1)
+                        self.log.debug(f"  ✓ {name} (0x{hash_type:02x}) - {'64' if not append_byte else '65'} bytes")
+                        passed += 1
+                    else:
+                        self.log.error(f"  ✗ {name} rejected: {result.get('reject-reason', 'Unknown')}")
+                        failed += 1
+
+                except Exception as e:
+                    self.log.error(f"  ✗ {name} exception: {e}")
+                    failed += 1
+
+            # Summary
+            self.log.debug(f"\nSIGHASH Types: {passed} passed, {failed} failed")
+
+            if failed > 0:
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError(f"{failed} SIGHASH type(s) failed")
+            else:
+                self.print_test_status(test_name, is_start=False, success=True)
+
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_op_cat(self):
+        """Test 3: OP_CAT with TAPSCRIPT_V2"""
+        test_name = "OP_CAT with TAPSCRIPT_V2"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            locking_script = CScript([bytes([1, 2]), bytes([3, 4]), OP_CAT, OP_EQUAL])
+            unlocking_script = [bytes([1, 2, 3, 4])]
+            result = self.test_simple_tapscript_v2_transaction(locking_script, unlocking_script)
+            self.print_test_status(test_name, is_start=False, success=result)
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_op_cat_exponential_growth(self):
+        """Test: OP_CAT exponential growth until varops budget exhausted"""
+        test_name = "OP_CAT exponential growth (DUP+CAT loop)"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            # Test cases: (iterations, expected_to_pass, description, rejection_reason)
+            # Each iteration: size *= 2, so 2^N bytes after N iterations
+            # Note: Transaction size limit is hit before varops budget in this test
+            test_cases = [
+                (5, True, "5 iterations: 1 -> 32 bytes", None),
+                (10, True, "10 iterations: 1 -> 1KB", None),
+                (15, True, "15 iterations: 1 -> 32KB", None),
+                (18, True, "18 iterations: 1 -> 256KB", None),
+                (20, False, "20 iterations: 1 -> 1MB", None),
+                (22, False, "22 iterations: 1 -> 4MB", None),
+            ]
+
+            passed = 0
+            failed = 0
+
+            for iterations, should_pass, description, expected_rejection in test_cases:
+                try:
+                    # Build script: start with 1 byte, then DUP+CAT repeatedly
+                    # Each iteration doubles the size: 1 -> 2 -> 4 -> 8 -> 16 -> 32 -> ...
+                    # After N iterations: 2^N bytes
+
+                    script_ops = [bytes([0xFF])]  # Start with 1 byte (0xFF)
+
+                    # Add DUP+CAT pairs for each iteration
+                    for _ in range(iterations):
+                        script_ops.append(OP_DUP)   # Duplicate top element
+                        script_ops.append(OP_CAT)   # Concatenate: doubles the size
+
+                    # Final size will be 2^iterations bytes
+                    final_size = 2 ** iterations
+
+                    # Script: [initial_byte, DUP, CAT, DUP, CAT, ..., EQUAL]
+                    locking_script = CScript(script_ops + [OP_LESSTHAN])
+                    unlocking_script = [bytes([0xFF])]
+
+                    # Create and test transaction
+                    utxo_info = self.create_tapscript_v2_funding_tx(locking_script, amount=0.1)
+                    spending_tx = self.create_tapscript_v2_spending_tx(utxo_info, extra_witness_elements=unlocking_script)
+
+                    result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+                    if should_pass:
+                        # Should be accepted
+                        if result['allowed']:
+                            self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                            self.generate(self.nodes[0], 1)
+                            self.log.debug(f"  ✓ {description} - PASSED (final size: {final_size} bytes)")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - should pass but rejected: {result.get('reject-reason', 'Unknown')}")
+                            failed += 1
+                    else:
+                        # Should be rejected - verify rejection reason
+                        if not result['allowed']:
+                            actual_reason = result.get('reject-reason', 'Unknown')
+                            if expected_rejection and expected_rejection in actual_reason:
+                                self.log.debug(f"  ✓ {description} - REJECTED correctly ({actual_reason})")
+                                passed += 1
+                            else:
+                                self.log.error(f"  ✗ {description} - rejected but wrong reason: expected '{expected_rejection}', got '{actual_reason}'")
+                                failed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - should be rejected but was accepted!")
+                            failed += 1
+
+                except Exception as e:
+                    if should_pass:
+                        self.log.error(f"  ✗ {description} - exception: {e}")
+                        failed += 1
+                    else:
+                        # Exception on expected failure is okay
+                        self.log.debug(f"  ✓ {description} - REJECTED (exception: {str(e)[:50]}...)")
+                        passed += 1
+
+            # Summary
+            self.log.debug(f"\nExponential growth tests: {passed} passed, {failed} failed")
+
+            if failed > 0:
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError(f"{failed} exponential growth test(s) failed")
+            else:
+                self.print_test_status(test_name, is_start=False, success=True)
+
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_op_mul_small(self):
+        """Test 4: OP_MUL with small numbers"""
+        test_name = "OP_MUL with small numbers (2 * 3 = 6)"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            locking_script = CScript([OP_2, OP_3, OP_MUL, OP_EQUAL])
+            unlocking_script = [bytes([6])]
+            result = self.test_simple_tapscript_v2_transaction(locking_script, unlocking_script)
+            self.print_test_status(test_name, is_start=False, success=result)
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_op_mul_large(self):
+        """Test 7: Large multiplication test with varops budget"""
+        test_name = "Large multiplication (27KB * 27KB with varops budget)"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            n = 1024*27  # max size to pay for its own varops budget
+            locking_script = CScript([bytes([255]*n), bytes([255]*n), OP_MUL, OP_EQUAL])
+            unlocking_script = [((2**(8*n)-1) * (2**(8*n)-1)).to_bytes(2*n, 'little')]
+            result = self.test_simple_tapscript_v2_transaction(locking_script, unlocking_script)
+            self.print_test_status(test_name, is_start=False, success=result)
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_op_mul_too_large(self):
+        """Test 8: Too large multiplication - should be REJECTED (exceeds varops budget)"""
+        test_name = "Too large multiplication - properly rejected"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            # Create a transaction that exceeds the varops budget
+            n = 1024*28  # 28KB operands
+            locking_script = CScript([bytes([255]*n), bytes([255]*n), OP_MUL, OP_EQUAL])
+            unlocking_script = [((2**(8*n)-1) * (2**(8*n)-1)).to_bytes(2*n, 'little')]
+
+            # Create the transaction
+            utxo_info = self.create_tapscript_v2_funding_tx(locking_script, amount=0.1)
+            spending_tx = self.create_tapscript_v2_spending_tx(utxo_info, extra_witness_elements=unlocking_script)
+
+            # Test that it's rejected
+            result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+            # Success means the transaction was properly REJECTED
+            if not result['allowed']:
+                # Expected rejection - test passes
+                self.print_test_status(test_name, is_start=False, success=True)
+            else:
+                # Transaction was accepted when it should have been rejected - test fails
+                self.log.error("Transaction should have been rejected but was accepted!")
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError("Transaction exceeding varops budget should have been rejected")
+
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_stack_size_limit(self):
+        """Test: Stack size limit - 32000 elements (new limit) vs 1000 (old limit)"""
+        test_name = "Stack size limit boundary (32000 elements)"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            # Test cases: (num_elements, should_pass, description)
+            test_cases = [
+                (1000, True, "1000 elements (old limit) - should still work"),
+                (10000, True, "10000 elements - well within new limit"),
+                (31999, True, "31999 elements - just below limit"),
+                (32000, True, "32000 elements - exactly at limit"),
+                (32001, False, "32001 elements - exceeds limit by 1"),
+                (35000, False, "35000 elements - clearly over limit"),
+            ]
+
+            passed = 0
+            failed = 0
+
+            for num_elements, should_pass, description in test_cases:
+                try:
+                    unlocking_script = [bytes([i % 256]) for i in range(num_elements)]
+
+                    script_ops = []
+                    for _ in range(num_elements):
+                        script_ops.append(OP_DROP)
+                    script_ops.append(OP_1)
+
+                    utxo_info = self.create_tapscript_v2_funding_tx(CScript(script_ops), amount=0.1)
+                    spending_tx = self.create_tapscript_v2_spending_tx(utxo_info, extra_witness_elements=unlocking_script)
+
+                    result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+                    if should_pass:
+                        if result['allowed']:
+                            self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                            self.generate(self.nodes[0], 1)
+                            self.log.debug(f"  ✓ {description}")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - rejected: {result.get('reject-reason', 'Unknown')}")
+                            failed += 1
+                    else:
+                        if not result['allowed']:
+                            self.log.debug(f"  ✓ {description} - correctly rejected")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - should be rejected but was accepted!")
+                            failed += 1
+
+                except Exception as e:
+                    if should_pass:
+                        self.log.error(f"  ✗ {description} - exception: {e}")
+                        failed += 1
+                    else:
+                        self.log.debug(f"  ✓ {description} - correctly rejected (exception)")
+                        passed += 1
+
+            self.log.debug(f"\nStack size tests: {passed} passed, {failed} failed")
+
+            if failed > 0:
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError(f"{failed} stack size test(s) failed")
+            else:
+                self.print_test_status(test_name, is_start=False, success=True)
+
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_stack_element_size_limit(self):
+        """Test: Stack element size limit - 4MB (new) vs 520 bytes (old)"""
+        test_name = "Stack element size limit boundary (4MB)"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            # Test cases: (element_size, should_pass, description)
+            # Note: We can't test 4MB elements directly because the transaction would exceed
+            # Bitcoin's 100KB standard transaction size limit. Instead, we test that we can
+            # CREATE 4MB elements using OP_CAT during script execution.
+            test_cases = [
+                (520, True, "520 bytes (old limit) - should still work"),
+                (1024, True, "1KB - well within new limit"),
+                (10000, True, "10KB - within new limit"),
+                (100000, True, "100KB - within new limit"),
+                (200000, True, "200KB - within new limit (approaching tx size limit)"),
+            ]
+
+            passed = 0
+            failed = 0
+
+            for element_size, should_pass, description in test_cases:
+                try:
+                    # Create a large element using OP_CAT to build it up
+                    # We'll push it via witness and check its size
+                    large_element = bytes([0x42] * element_size)
+
+                    # Script: check that the pushed element equals itself (always true)
+                    locking_script = CScript([OP_DUP, OP_EQUAL])
+                    unlocking_script = [large_element]
+
+                    utxo_info = self.create_tapscript_v2_funding_tx(locking_script, amount=0.1)
+                    spending_tx = self.create_tapscript_v2_spending_tx(utxo_info, extra_witness_elements=unlocking_script)
+
+                    result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+                    if should_pass:
+                        if result['allowed']:
+                            self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                            self.generate(self.nodes[0], 1)
+                            self.log.debug(f"  ✓ {description}")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - rejected: {result.get('reject-reason', 'Unknown')}")
+                            failed += 1
+                    else:
+                        if not result['allowed']:
+                            self.log.debug(f"  ✓ {description} - correctly rejected")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - should be rejected but was accepted!")
+                            failed += 1
+
+                except Exception as e:
+                    if should_pass:
+                        self.log.error(f"  ✗ {description} - exception: {e}")
+                        failed += 1
+                    else:
+                        self.log.debug(f"  ✓ {description} - correctly rejected (exception)")
+                        passed += 1
+
+            self.log.debug(f"\nStack element size tests: {passed} passed, {failed} failed")
+
+            if failed > 0:
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError(f"{failed} stack element size test(s) failed")
+            else:
+                self.print_test_status(test_name, is_start=False, success=True)
+
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_total_stack_size_limit(self):
+        """Test: Total stack size limit - 8MB across all elements"""
+        test_name = "Total stack size limit boundary (8MB)"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            # Test cases: (num_elements, element_size, should_pass, description)
+            # Total = num_elements * element_size
+            # Note: Limited by Bitcoin's 100KB transaction size limit for witness data
+            test_cases = [
+                (10, 10000, True, "10 x 10KB = 100KB - well within limit"),
+                (20, 10000, True, "20 x 10KB = 200KB - within limit"),
+                (100, 1000, True, "100 x 1KB = 100KB - within limit"),
+                (1000, 100, True, "1000 x 100B = 100KB - within limit"),
+            ]
+
+            passed = 0
+            failed = 0
+
+            for num_elements, element_size, should_pass, description in test_cases:
+                try:
+                    # Push multiple large elements onto the stack
+                    # Then verify the stack has the expected depth
+                    script_ops = []
+                    unlocking_script = []
+
+                    # Push elements via witness
+                    for i in range(num_elements):
+                        unlocking_script.append(bytes([0x42] * element_size))
+
+                    # Script: drop all elements and return success
+                    # This tests that we CAN have num_elements on the stack at once
+                    for _ in range(num_elements):
+                        script_ops.append(OP_DROP)
+                    script_ops.append(OP_1)
+
+                    locking_script = CScript(script_ops)
+
+                    utxo_info = self.create_tapscript_v2_funding_tx(locking_script, amount=0.1)
+                    spending_tx = self.create_tapscript_v2_spending_tx(utxo_info, extra_witness_elements=unlocking_script)
+
+                    result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+                    if should_pass:
+                        if result['allowed']:
+                            self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                            self.generate(self.nodes[0], 1)
+                            self.log.debug(f"  ✓ {description}")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - rejected: {result.get('reject-reason', 'Unknown')}")
+                            failed += 1
+                    else:
+                        if not result['allowed']:
+                            self.log.debug(f"  ✓ {description} - correctly rejected")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - should be rejected but was accepted!")
+                            failed += 1
+
+                except Exception as e:
+                    if should_pass:
+                        self.log.error(f"  ✗ {description} - exception: {e}")
+                        failed += 1
+                    else:
+                        self.log.debug(f"  ✓ {description} - correctly rejected (exception)")
+                        passed += 1
+
+            self.log.debug(f"\nTotal stack size tests: {passed} passed, {failed} failed")
+
+            if failed > 0:
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError(f"{failed} total stack size test(s) failed")
+            else:
+                self.print_test_status(test_name, is_start=False, success=True)
+
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_witness_element_size_limit(self):
+        """Test: TAPSCRIPT_V2 allows elements >520 bytes (old limit) in witness"""
+        test_name = "Witness element size: >520 bytes allowed in TAPSCRIPT_V2"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            # NOTE: We can't directly test the 4MB limit because Bitcoin's 100KB
+            # transaction size limit prevents creating such large witness data.
+            #
+            # Instead, this test validates that elements LARGER than the old 520-byte
+            # limit are now ACCEPTED in TAPSCRIPT_V2 witness data.
+            #
+            # If the TAPSCRIPT_V2 check were missing and it fell back to the old
+            # MAX_SCRIPT_ELEMENT_SIZE check, this test would FAIL.
+
+            # Test cases: (element_size, should_pass, description)
+            test_cases = [
+                (520, True, "520 bytes (old limit) - should work"),
+                (1000, True, "1000 bytes - exceeds old 520 limit, should work in v2"),
+                (5000, True, "5000 bytes - well above old limit"),
+                (10000, True, "10000 bytes - 10KB element"),
+            ]
+
+            passed = 0
+            failed = 0
+
+            for element_size, should_pass, description in test_cases:
+                try:
+                    # Create a witness element of the specified size
+                    large_element = bytes([0x42] * element_size)
+
+                    # Simple script that drops the element and returns true
+                    locking_script = CScript([OP_DROP, OP_1])
+                    unlocking_script = [large_element]
+
+                    utxo_info = self.create_tapscript_v2_funding_tx(locking_script, amount=0.1)
+                    spending_tx = self.create_tapscript_v2_spending_tx(utxo_info, extra_witness_elements=unlocking_script)
+
+                    result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+                    if should_pass:
+                        if result['allowed']:
+                            self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                            self.generate(self.nodes[0], 1)
+                            self.log.debug(f"  ✓ {description}")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - rejected: {result.get('reject-reason', 'Unknown')}")
+                            self.log.error("     This likely means TAPSCRIPT_V2 is using old 520-byte limit!")
+                            failed += 1
+                    else:
+                        if not result['allowed']:
+                            self.log.debug(f"  ✓ {description} - correctly rejected")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - should be rejected!")
+                            failed += 1
+
+                except Exception as e:
+                    self.log.error(f"  ✗ {description} - exception: {e}")
+                    failed += 1
+
+            self.log.debug(f"\nWitness element size tests: {passed} passed, {failed} failed")
+
+            if failed > 0:
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError(f"{failed} witness element test(s) failed")
+            else:
+                self.print_test_status(test_name, is_start=False, success=True)
+
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_cat_creates_large_element(self):
+        """Test: OP_CAT can create elements up to 4MB by doubling"""
+        test_name = "OP_CAT creating large elements via exponential growth"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            # Test cases: (num_doublings, should_pass, description)
+            # Each doubling: size *= 2, starting from 1 byte
+            # After N doublings: 2^N bytes
+            # We want to test approaching and exceeding the 4MB (4,000,000 byte) limit
+            # NOTE: OP_CAT consumes varops budget, so very large elements will hit varops
+            # budget before hitting the 4MB element size limit. The element size limit
+            # can be tested more directly by pushing large elements via witness.
+            # 2^22 = 4,194,304 bytes (just over 4MB)
+            # 2^19 = 524,288 bytes (512KB)
+            test_cases = [
+                (10, True, "10 doublings: 1 -> 1KB"),
+                (15, True, "15 doublings: 1 -> 32KB"),
+                (18, True, "18 doublings: 1 -> 256KB"),
+                (19, True, "19 doublings: 1 -> 512KB"),
+                (22, False, "22 doublings: 1 -> 4MB+ (exceeds 4MB element size limit)"),
+            ]
+
+            passed = 0
+            failed = 0
+
+            for num_doublings, should_pass, description in test_cases:
+                try:
+                    # Build script: start with 1 byte, then DUP+CAT repeatedly
+                    # Each iteration doubles the size: 1 -> 2 -> 4 -> 8 -> 16 -> ...
+                    script_ops = [bytes([0xFF])]  # Start with 1 byte
+
+                    for _ in range(num_doublings):
+                        script_ops.append(OP_DUP)   # Duplicate top element
+                        script_ops.append(OP_CAT)   # Concatenate: doubles the size
+
+                    # Final size will be 2^num_doublings bytes
+                    final_size = 2 ** num_doublings
+
+                    # Drop the result and return OP_1 (we just want to test the CAT worked)
+                    script_ops.append(OP_DROP)
+                    script_ops.append(OP_1)
+
+                    locking_script = CScript(script_ops)
+                    unlocking_script = []
+
+                    utxo_info = self.create_tapscript_v2_funding_tx(locking_script, amount=0.1)
+                    spending_tx = self.create_tapscript_v2_spending_tx(utxo_info, extra_witness_elements=unlocking_script)
+
+                    result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+                    if should_pass:
+                        if result['allowed']:
+                            self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                            self.generate(self.nodes[0], 1)
+                            self.log.debug(f"  ✓ {description} (final: {final_size:,} bytes)")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - rejected: {result.get('reject-reason', 'Unknown')}")
+                            failed += 1
+                    else:
+                        if not result['allowed']:
+                            self.log.debug(f"  ✓ {description} - correctly rejected (would be {final_size:,} bytes)")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - should be rejected but was accepted!")
+                            failed += 1
+
+                except Exception as e:
+                    if should_pass:
+                        self.log.error(f"  ✗ {description} - exception: {e}")
+                        failed += 1
+                    else:
+                        self.log.debug(f"  ✓ {description} - correctly rejected (exception)")
+                        passed += 1
+
+            self.log.debug(f"\nOP_CAT large element tests: {passed} passed, {failed} failed")
+
+            if failed > 0:
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError(f"{failed} OP_CAT test(s) failed")
+            else:
+                self.print_test_status(test_name, is_start=False, success=True)
+
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_merkle_proof_verification(self):
+        """Test: Merkle tree proof verification using OP_CAT + OP_SHA256
+
+        Real-world use case: Light client verification, inclusion proofs, covenant validation.
+        This demonstrates one of the most important applications of OP_CAT - the ability to
+        verify merkle proofs on-chain without requiring a signature oracle.
+        """
+        test_name = "Merkle proof verification (OP_CAT + OP_SHA256)"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            # Build a simple merkle tree with 4 leaves
+            # Tree structure:
+            #        root
+            #       /    \
+            #    hash01  hash23
+            #    /  \    /  \
+            #   L0  L1  L2  L3
+
+            leaf0 = hashlib.sha256(b"data0").digest()
+            leaf1 = hashlib.sha256(b"data1").digest()
+            leaf2 = hashlib.sha256(b"data2").digest()
+            leaf3 = hashlib.sha256(b"data3").digest()
+
+            # Build intermediate hashes
+            hash01 = hashlib.sha256(leaf0 + leaf1).digest()
+            hash23 = hashlib.sha256(leaf2 + leaf3).digest()
+
+            # Build root
+            root = hashlib.sha256(hash01 + hash23).digest()
+
+            # Test case: Prove that leaf0 is in the tree
+            # Proof path: [leaf0, leaf1, hash23] -> verify equals root
+            # Steps:
+            # 1. CAT(leaf0, leaf1) -> leaf0+leaf1
+            # 2. SHA256 -> hash01
+            # 3. CAT(hash01, hash23) -> hash01+hash23
+            # 4. SHA256 -> root
+            # 5. EQUAL(computed_root, expected_root)
+
+            # Script:
+            # Witness provides: [leaf0, leaf1] (pushed in this order, so stack is [leaf0, leaf1] with leaf1 on top)
+            # OP_CAT pops B (top=leaf1), pops A (second=leaf0), then does A+B = leaf0+leaf1
+            # Script:
+            #   OP_CAT OP_SHA256    # hash(leaf0 + leaf1) = hash01
+            #   <hash23> OP_CAT OP_SHA256  # hash(hash01 + hash23) = root
+            #   <expected_root> OP_EQUAL
+
+            locking_script = CScript([
+                OP_CAT,           # Stack: [leaf0+leaf1] (OP_CAT does second+top)
+                OP_SHA256,        # Stack: [hash01]
+                hash23,           # Stack: [hash01, hash23]
+                OP_CAT,           # Stack: [hash01+hash23] (OP_CAT does second+top)
+                OP_SHA256,        # Stack: [computed_root]
+                root,             # Stack: [computed_root, expected_root]
+                OP_EQUAL          # Stack: [1 if equal]
+            ])
+
+            # Witness: provide leaf0 and leaf1 (proving leaf0 is in tree)
+            # They are pushed in order, creating stack [leaf0, leaf1] with leaf1 on top
+            unlocking_script = [leaf0, leaf1]
+
+            result = self.test_simple_tapscript_v2_transaction(locking_script, unlocking_script)
+
+            if result:
+                self.log.debug("  ✓ Successfully verified merkle proof on-chain")
+                self.log.debug(f"  ✓ Proved leaf0 ({leaf0.hex()[:16]}...) is in tree")
+                self.log.debug(f"  ✓ Root: {root.hex()[:32]}...")
+                self.print_test_status(test_name, is_start=False, success=True)
+            else:
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError("Merkle proof verification failed")
+
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_op_checklocktimeverify(self):
+        """Test: OP_CHECKLOCKTIMEVERIFY with various lock times"""
+        test_name = "OP_CHECKLOCKTIMEVERIFY (block height and timestamp)"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            # Test cases: (height_offset_or_time, nSequence, should_pass, description, is_timestamp)
+            # For block height tests: offset is relative to current height (can be negative, 0, or positive)
+            # For timestamp tests: offset is relative to current time
+            # LOCKTIME_THRESHOLD = 500'000'000
+            # Below threshold = block height, above = timestamp
+            test_cases = [
+                # Block height tests (relative offsets)
+                (-10, 0xFFFFFFFE, True, "Block height: 10 blocks ago (should pass)", False),
+                (0, 0xFFFFFFFE, True, "Block height: current height (should pass)", False),
+                (1, 0xFFFFFFFE, True, "Block height: 1 block in the future (should still pass)", False),
+                (2, 0xFFFFFFFE, False, "Block height: 2 blocks in the future (should fail)", False),
+                (+1000, 0xFFFFFFFE, False, "Block height: far future (should fail)", False),
+
+                # Timestamp tests (relative offsets in seconds)
+                # Note: Bitcoin uses Median Time Past (MTP), not current block time
+                (-3600, 0xFFFFFFFE, True, "Timestamp: 1 hour ago (should pass)", True),
+                (-60, 0xFFFFFFFE, True, "Timestamp: 1 minute ago (should pass)", True),
+                (+86400, 0xFFFFFFFE, False, "Timestamp: 1 day in future (should fail)", True),
+
+                # nSequence tests (with block height)
+                (-10, SEQUENCE_FINAL, False, "nSequence = FINAL (should fail)", False),
+                (-10, 0, True, "nSequence = 0 (should pass)", False),
+            ]
+
+            passed = 0
+            failed = 0
+
+            for offset, nSequence, should_pass, description, is_timestamp in test_cases:
+                # Capture fresh current height/time for each test iteration
+                current_height = self.nodes[0].getblockcount()
+                current_time = self.nodes[0].getblock(self.nodes[0].getbestblockhash())['time']
+
+                # Calculate actual locktime based on offset
+                if is_timestamp:
+                    locktime = current_time + offset
+                else:
+                    locktime = current_height + offset
+                try:
+                    # Create script that checks locktime
+                    # Script: <locktime_value> OP_CHECKLOCKTIMEVERIFY OP_DROP OP_1
+                    # The OP_DROP is needed because CLTV doesn't consume its argument
+                    locking_script = CScript([locktime, OP_CHECKLOCKTIMEVERIFY, OP_DROP, OP_1])
+                    unlocking_script = []
+
+                    # Create funding transaction
+                    utxo_info = self.create_tapscript_v2_funding_tx(locking_script, amount=0.1)
+
+                    # Create spending transaction with specific nLockTime and nSequence
+                    spending_tx = CTransaction()
+                    spending_tx.nLockTime = locktime  # Set transaction locktime
+                    spending_tx.vin = [CTxIn(
+                        COutPoint(int(utxo_info["funding_txid"], 16), utxo_info["funding_vout"]),
+                        b"",
+                        nSequence  # Use specified nSequence
+                    )]
+
+                    # Create output
+                    output_address = self.nodes[0].getnewaddress()
+                    output_script = bytes.fromhex(self.nodes[0].validateaddress(output_address)["scriptPubKey"])
+                    output_amount = int((utxo_info["amount"] - 0.001) * 100000000)
+                    spending_tx.vout = [CTxOut(output_amount, output_script)]
+
+                    # Create witness
+                    tap = utxo_info["tap"]
+                    script = utxo_info["script"]
+                    leaf_info = tap.leaves["script"]
+                    control_block = bytes([leaf_info.version + tap.negflag]) + tap.internal_pubkey + leaf_info.merklebranch
+
+                    spending_tx.wit.vtxinwit = [CTxInWitness()]
+                    spending_tx.wit.vtxinwit[0].scriptWitness.stack = unlocking_script + [script, control_block]
+
+                    # Test transaction
+                    result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+                    if should_pass:
+                        if result['allowed']:
+                            self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                            self.generate(self.nodes[0], 1)
+                            self.log.debug(f"  ✓ {description}")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - rejected: {result.get('reject-reason', 'Unknown')}")
+                            failed += 1
+                    else:
+                        if not result['allowed']:
+                            self.log.debug(f"  ✓ {description} - correctly rejected ({result.get('reject-reason', 'Unknown')})")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - should be rejected but was accepted!")
+                            failed += 1
+
+                except Exception as e:
+                    if should_pass:
+                        self.log.error(f"  ✗ {description} - exception: {e}")
+                        failed += 1
+                    else:
+                        self.log.debug(f"  ✓ {description} - correctly rejected (exception)")
+                        passed += 1
+
+            self.log.debug(f"\nOP_CHECKLOCKTIMEVERIFY tests: {passed} passed, {failed} failed")
+
+            if failed > 0:
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError(f"{failed} CLTV test(s) failed")
+            else:
+                self.print_test_status(test_name, is_start=False, success=True)
+
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def test_varops_budget_exceeded_by_signature_reuse(self):
+        """Test: Exceed varops budget by reusing the same signature many times
+
+        Since each signature costs 260,000 varops but adding a new signature to
+        the witness adds ~100 weight units (giving 520,000 budget), signatures are
+        "self-funding" and we can't exceed the budget just by adding more signatures.
+
+        However, we CAN exceed the budget by verifying the SAME signature multiple
+        times using OP_DUP. This way weight stays low but varops cost is high.
+
+        Test various numbers of signature verifications around the critical value
+        to determine exactly how many should be allowed based on transaction weight.
+        """
+        test_name = "Varops budget: Exceeded by signature reuse"
+        self.print_test_status(test_name, is_start=True)
+
+        try:
+            # Generate one key
+            key = ECKey()
+            key.generate()
+            pubkey_xonly, _ = compute_xonly_pubkey(key.get_bytes())
+
+            # Test cases: (num_verifications, should_pass, description)
+            test_cases = [
+                (1, None, "1 verification - well within budget"),
+                (9, None, "9 verification - within budget"),
+                (10, None, "10 verification - exceeds budget"),
+                (20, None, "20 verifications - way over budget")
+            ]
+
+            passed = 0
+            failed = 0
+
+            for num_verifications, should_pass, description in test_cases:
+                try:
+                    # Create a script that duplicates the signature and verifies it many times
+                    # Pattern: <sig on witness> <pubkey> OP_2DUP OP_CHECKSIG OP_VERIFY ... (repeat)
+                    # This reuses the same sig without adding weight
+                    script_ops = []
+                    for i in range(num_verifications):
+                        if i == 0:
+                            # First time: sig and pubkey are on stack
+                            script_ops.extend([pubkey_xonly, OP_2DUP, OP_CHECKSIG, OP_VERIFY])
+                        else:
+                            # Subsequent times: dup the sig and pubkey, then check
+                            script_ops.extend([OP_2DUP, OP_CHECKSIG, OP_VERIFY])
+                    # Clean up stack and return true
+                    script_ops.extend([OP_2DROP, OP_1])
+
+                    locking_script = CScript(script_ops)
+
+                    # Create funding transaction
+                    utxo_info = self.create_tapscript_v2_funding_tx(locking_script, amount=0.1)
+
+                    # Create spending transaction
+                    spending_tx = self.create_tapscript_v2_spending_tx(utxo_info)
+                    spent_output = CTxOut(int(utxo_info["amount"] * 100000000), utxo_info["tap"].scriptPubKey)
+
+                    # Compute sighash
+                    sighash = TaprootSignatureHash(
+                        spending_tx,
+                        [spent_output],
+                        0,
+                        0,
+                        scriptpath=True,
+                        leaf_script=locking_script,
+                        codeseparator_pos=-1,
+                        leaf_ver=LEAF_VERSION_TAPSCRIPT_V2
+                    )
+
+                    sig = sign_schnorr(key.get_bytes(), sighash)
+
+                    spending_tx.wit.vtxinwit[0].scriptWitness.stack.insert(0, sig)
+
+                    tx_weight = spending_tx.get_weight()
+                    varops_budget = tx_weight * 5200
+                    varops_used = num_verifications * 260000  # Each CHECKSIG costs 260,000
+                    max_verifications_for_weight = varops_budget // 260000
+
+                    self.log.debug(f"\n  Testing {num_verifications} verifications:")
+                    self.log.debug(f"    Transaction weight: {tx_weight}")
+                    self.log.debug(f"    Varops budget: {varops_budget:,}")
+                    self.log.debug(f"    Varops used: {varops_used:,} ({num_verifications} CHECKSIGs × 260,000)")
+                    self.log.debug(f"    Max verifications for this weight: {max_verifications_for_weight}")
+                    self.log.debug(f"    Budget remaining: {varops_budget - varops_used:,}")
+
+                    result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]
+
+                    if should_pass is None:
+                        should_pass = varops_used <= varops_budget
+
+                    if should_pass:
+                        if result['allowed']:
+                            self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                            self.generate(self.nodes[0], 1)
+                            self.log.debug(f"  ✓ {description} - PASSED (within budget)")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - rejected but should pass: {result.get('reject-reason', 'Unknown')}")
+                            failed += 1
+                    else:
+                        if not result['allowed']:
+                            actual_reason = result.get('reject-reason', 'Unknown')
+                            self.log.debug(f"  ✓ {description} - REJECTED correctly ({actual_reason})")
+                            passed += 1
+                        else:
+                            self.log.error(f"  ✗ {description} - should be rejected but was accepted!")
+                            failed += 1
+
+                except Exception as e:
+                    if should_pass:
+                        self.log.error(f"  ✗ {description} - exception: {e}")
+                        failed += 1
+                    else:
+                        self.log.debug(f"  ✓ {description} - REJECTED (exception: {str(e)[:50]}...)")
+                        passed += 1
+
+            self.log.debug(f"\nVarops signature reuse tests: {passed} passed, {failed} failed")
+
+            if failed > 0:
+                self.print_test_status(test_name, is_start=False, success=False)
+                raise AssertionError(f"{failed} varops signature reuse test(s) failed")
+            else:
+                self.print_test_status(test_name, is_start=False, success=True)
+
+        except Exception as e:
+            self.log.error(f"Exception in test: {e}")
+            self.print_test_status(test_name, is_start=False, success=False)
+            raise
+
+    def run_test(self):
+        self.generate(self.nodes[0], COINBASE_MATURITY + 1)
+
+        self.test_simple_op1_script()
+        self.test_op_checksig_basic()
+        self.test_keypath_spend()
+        self.test_multiple_leaves()
+        self.test_multisig_2of2()
+        self.test_sighash_types()
+        self.test_op_cat()
+        self.test_op_mul_small()
+        self.test_op_mul_large()
+        self.test_op_mul_too_large()
+
+        self.test_stack_size_limit()
+        self.test_stack_element_size_limit()
+        self.test_total_stack_size_limit()
+        self.test_witness_element_size_limit()
+        self.test_cat_creates_large_element()
+
+        self.test_varops_budget_exceeded_by_signature_reuse()
+
+        self.test_op_checklocktimeverify()
+
+        self.test_merkle_proof_verification()
+
+    def create_tapscript_funding_tx(self, tapscript, internal_key=None, amount=1.0, leaf_version=LEAF_VERSION_TAPSCRIPT_V2):
+        """Create a funding transaction with a tapscript P2TR output."""
+        if internal_key is None:
+            SEED = 317
+            prv: bytes = hashlib.sha256(SEED.to_bytes(2, 'big') + bytes([0])).digest()
+            internal_key = prv
+
+        pubkey_bytes, _ = compute_xonly_pubkey(internal_key)
+
+        tap = taproot_construct(pubkey_bytes, [("script", tapscript, leaf_version)])
+        address = encode_segwit_address("bcrt", 1, tap.output_pubkey)
+
+        funding_txid = self.nodes[0].sendtoaddress(address, amount)
+        self.generate(self.nodes[0], 1)
+
+        # Get the funding transaction and find the correct vout
+        funding_tx_info = self.nodes[0].gettransaction(funding_txid)
+        funding_tx_decoded = self.nodes[0].decoderawtransaction(funding_tx_info['hex'])
+
+        # Find the correct vout by matching the scriptPubKey directly
+        funding_vout = None
+        expected_scriptpubkey = f"5120{tap.output_pubkey.hex()}"
+
+        for i, vout in enumerate(funding_tx_decoded['vout']):
+            if vout['scriptPubKey']['hex'] == expected_scriptpubkey:
+                funding_vout = i
+                break
+
+        assert funding_vout is not None, f"Could not find funding output with scriptPubKey {expected_scriptpubkey}"
+
+        return {
+            "funding_txid": funding_txid,
+            "funding_vout": funding_vout,
+            "amount": amount,
+            "tap": tap,
+            "internal_key": internal_key,
+            "address": address,
+            "script": tapscript
+        }
+
+    def create_tapscript_v2_funding_tx(self, tapscript_v2, internal_key=None, amount=1.0):
+        """Create a funding transaction with a TAPSCRIPT_V2 P2TR output."""
+        return self.create_tapscript_funding_tx(tapscript_v2, internal_key, amount, LEAF_VERSION_TAPSCRIPT_V2)
+
+    def create_tapscript_v2_spending_tx(self, utxo_info, extra_witness_elements=None):
+        """Create a spending transaction for a TAPSCRIPT_V2 UTXO."""
+        spending_tx = CTransaction()
+        spending_tx.vin = [CTxIn(COutPoint(int(utxo_info["funding_txid"], 16), utxo_info["funding_vout"]), b"", SEQUENCE_FINAL)]
+
+        # Create output (send back to wallet for simplicity)
+        output_address = self.nodes[0].getnewaddress()
+        output_script = bytes.fromhex(self.nodes[0].validateaddress(output_address)["scriptPubKey"])
+        output_amount = int((utxo_info["amount"] - 0.001) * 100000000)  # Subtract fee
+        spending_tx.vout = [CTxOut(output_amount, output_script)]
+
+        # Create witness for TAPSCRIPT_V2 script path spending
+        tap = utxo_info["tap"]
+        script = utxo_info["script"]
+
+        # Get the leaf info for our script (we named it "script" when creating the taproot)
+        leaf_info = tap.leaves["script"]
+        control_block = bytes([leaf_info.version + tap.negflag]) + tap.internal_pubkey + leaf_info.merklebranch
+
+        witness_elements = extra_witness_elements if extra_witness_elements else []
+        witness_elements.append(script)
+        witness_elements.append(control_block)
+
+        spending_tx.wit.vtxinwit = [CTxInWitness()]
+        spending_tx.wit.vtxinwit[0].scriptWitness.stack = witness_elements
+
+        return spending_tx
+
+    def test_simple_tapscript_v2_transaction(self, locking_script, unlocking_script) -> bool:
+        """Test creation and validation of TAPSCRIPT_V2 transactions."""
+
+        try:
+            utxo_info = self.create_tapscript_v2_funding_tx(locking_script, amount=0.1)
+            self.log.debug(f"✓ Created TAPSCRIPT_V2 funding transaction: {utxo_info['funding_txid']}")
+            spending_tx = self.create_tapscript_v2_spending_tx(utxo_info, extra_witness_elements=unlocking_script)
+            self.log.debug(f"✓ Created TAPSCRIPT_V2 spending transaction: {spending_tx.rehash()}")
+
+            # # print tx size
+            # self.log.debug(f"Tx size: {len(spending_tx.serialize())} B")
+            # # print tx weight
+            # self.log.debug(f"Tx weight: {spending_tx.get_weight()} wu")
+            # # print varops budget
+
+            # Use maxfeerate=0 to bypass the fee rate validation bug
+            # There appears to be a bug in the fee rate comparison logic where
+            # valid fee rates are incorrectly rejected as "max-fee-exceeded"
+            result = self.nodes[0].testmempoolaccept([spending_tx.serialize().hex()], maxfeerate=0)[0]  # No fee limit
+
+            if result['allowed']:
+                self.log.debug("✓ TAPSCRIPT_V2 transaction accepted")
+
+                # broadcast transaction
+                self.nodes[0].sendrawtransaction(spending_tx.serialize().hex())
+                self.log.debug("✓ TAPSCRIPT_V2 transaction broadcasted")
+                self.generate(self.nodes[0], 1)
+
+                # wait for mempool to clear
+                self.generate(self.nodes[0], 1)
+                self.log.debug("✓ TAPSCRIPT_V2 transaction mempool cleared")
+                self.generate(self.nodes[0], 1)
+                self.log.debug("✓ TAPSCRIPT_V2 transaction mined")
+            else:
+                self.log.debug(f"✗ TAPSCRIPT_V2 transaction rejected: {result.get('reject-reason', 'Unknown reason')}")
+                self.log.debug(f"Stack top: {spending_tx.wit.vtxinwit[0].scriptWitness.stack[-1].hex()}")
+            return result['allowed']
+
+        except Exception as e:
+            self.log.debug(f"Exception: {e}")
+            return False
+
+if __name__ == '__main__':
+    TapscriptV2Test(__file__).main()
diff --git a/test/functional/test_framework/script.py b/test/functional/test_framework/script.py
index 0a33838b1276..d6a51e66b768 100644
--- a/test/functional/test_framework/script.py
+++ b/test/functional/test_framework/script.py
@@ -33,6 +33,7 @@
 KEY_VERSION_TAPROOT = 0x00
 KEY_VERSION_ANYPREVOUT = 0x01
 
+LEAF_VERSION_TAPSCRIPT_V2 = 0xc2
 
 def hash160(s):
     return ripemd160(sha256(s))
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index 5f57818afdbb..2f92ac3bfe4c 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -95,6 +95,7 @@
     # vv Tests less than 5m vv
     'feature_fee_estimation.py',
     'feature_taproot.py',
+    'feature_tapscript_v2.py',
     'feature_block.py',
     'mempool_ephemeral_dust.py',
     'wallet_conflicts.py --legacy-wallet',
diff --git a/test/lint/verify-evalscript-copy.sh b/test/lint/verify-evalscript-copy.sh
new file mode 100755
index 000000000000..2a75496443a9
--- /dev/null
+++ b/test/lint/verify-evalscript-copy.sh
@@ -0,0 +1,91 @@
+#!/bin/bash
+# Copyright (c) 2026 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+# Verifies that a commit copies EvalScript() without modifying the function body.
+# Usage: ./verify-evalscript-copy.sh <commit_hash>
+
+export LC_ALL=C
+
+set -e
+
+if [ -z "$1" ]; then
+    echo "Usage: $0 <commit_hash>"
+    exit 1
+fi
+
+COMMIT="$1"
+PARENT="${COMMIT}^"
+FILE="src/script/interpreter.cpp"
+
+TMPDIR="${TMPDIR:-/tmp}"
+ORIGINAL_BODY=$(mktemp "${TMPDIR}/original_body.XXXXXX")
+COPIED_BODY=$(mktemp "${TMPDIR}/copied_body.XXXXXX")
+
+cleanup() {
+    rm -f "$ORIGINAL_BODY" "$COPIED_BODY"
+}
+trap cleanup EXIT
+
+echo "=== Verifying EvalScript copy in commit $COMMIT ==="
+echo
+
+echo "Locating original EvalScript in parent commit..."
+ORIG_START=$(git show ${PARENT}:${FILE} | grep -n "^bool EvalScript.*ScriptExecutionData& execdata, ScriptError" | head -1 | cut -d: -f1)
+if [ -z "$ORIG_START" ]; then
+    echo "ERROR: Could not find original EvalScript in parent commit"
+    exit 1
+fi
+echo "  Found at line $ORIG_START"
+
+echo "Extracting original EvalScript body..."
+git show ${PARENT}:${FILE} | tail -n +${ORIG_START} | awk '
+    BEGIN { brace_count = 0; started = 0 }
+    /^bool EvalScript/ { started = 1; next }
+    started {
+        print
+        brace_count += gsub(/{/, "{")
+        brace_count -= gsub(/}/, "}")
+        if (brace_count == 0 && NR > 1) exit
+    }
+' > "$ORIGINAL_BODY"
+
+echo "Locating copied EvalScript in commit..."
+COPY_START=$(git show ${COMMIT}:${FILE} | grep -n "^bool EvalScript.*varops_budget" | head -1 | cut -d: -f1)
+if [ -z "$COPY_START" ]; then
+    echo "ERROR: Could not find copied EvalScript with varops_budget in commit"
+    exit 1
+fi
+echo "  Found at line $COPY_START"
+
+echo "Extracting copied EvalScript body..."
+git show ${COMMIT}:${FILE} | tail -n +${COPY_START} | awk '
+    BEGIN { brace_count = 0; started = 0 }
+    /^bool EvalScript/ { started = 1; next }
+    started {
+        print
+        brace_count += gsub(/{/, "{")
+        brace_count -= gsub(/}/, "}")
+        if (brace_count == 0 && NR > 1) exit
+    }
+' > "$COPIED_BODY"
+
+echo
+echo "Original body: $(wc -l < "$ORIGINAL_BODY" | tr -d ' ') lines"
+echo "Copied body:   $(wc -l < "$COPIED_BODY" | tr -d ' ') lines"
+
+echo
+BODY_DIFF=$(diff "$ORIGINAL_BODY" "$COPIED_BODY" 2>&1 || true)
+
+if [ -z "$BODY_DIFF" ]; then
+    echo "=== RESULT ==="
+    echo "SUCCESS: Function bodies are IDENTICAL"
+else
+    echo "=== RESULT ==="
+    echo "FAILURE: Function bodies DIFFER"
+    echo
+    echo "Differences:"
+    echo "$BODY_DIFF"
+    exit 1
+fi
diff --git a/test/sanitizer_suppressions/ubsan b/test/sanitizer_suppressions/ubsan
index 6e636b56b8e7..75fed5d25901 100644
--- a/test/sanitizer_suppressions/ubsan
+++ b/test/sanitizer_suppressions/ubsan
@@ -59,6 +59,15 @@ unsigned-integer-overflow:InsecureRandomContext::rand64
 unsigned-integer-overflow:InsecureRandomContext::SplitMix64
 unsigned-integer-overflow:bitset_detail::PopCount
 implicit-integer-sign-change:CBlockPolicyEstimator::processBlockTx
+unsigned-integer-overflow:val64.cpp
+unsigned-integer-overflow:bench/val64.cpp
+unsigned-integer-overflow:bench/bench_varops.cpp
+implicit-integer-sign-change:val64.cpp
+implicit-integer-sign-change:bench/val64.cpp
+implicit-unsigned-integer-truncation:val64.cpp
+implicit-unsigned-integer-truncation:bench/val64.cpp
+shift-base:val64.cpp
+shift-base:bench/val64.cpp
 implicit-integer-sign-change:SetStdinEcho
 implicit-integer-sign-change:compressor.h
 implicit-integer-sign-change:crypto/