From 4b5e94f7a324e9b9a4ae1dd0a1677cedd3839c20 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 14 Oct 2026 09:29:32 -0500
Subject: [PATCH 1/5] fix(net): avoid unsigned wrap when compressing header
 timestamps

CompressibleBlockHeader::Compress subtracted the previous header's nTime
from the current one as uint32_t. A block may legitimately be timestamped
earlier than its parent (only the median time past bounds it), and then the
subtraction wraps. The wrapped value never fit the int16_t offset, so such
headers were already sent with their full timestamp and the wire output was
correct, but -fsanitize=integer builds abort on the overflow while serving
headers.

Only compute the offset when it cannot wrap. Headers timestamped before
their parent keep being sent in full, so the encoding on the wire is
unchanged and no negative offset reaches the decompressor.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/primitives/block.cpp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/primitives/block.cpp b/src/primitives/block.cpp
index a7ec5a0823ea..710e30cad543 100644
--- a/src/primitives/block.cpp
+++ b/src/primitives/block.cpp
@@ -79,10 +79,10 @@ void CompressibleBlockHeader::Compress(const std::vector<CompressibleBlockHeader
     const auto& last_block = previous_blocks.back();
     bit_field.MarkAsCompressed(CompressedHeaderBitField::Flag::PREV_BLOCK_HASH);
 
-    // Compute compressed time diff
-    const int64_t time_diff = nTime - last_block.nTime;
-    if (time_diff <= std::numeric_limits<int16_t>::max() && time_diff >= std::numeric_limits<int16_t>::min()) {
-        time_offset = static_cast<int16_t>(time_diff);
+    // Compute compressed time diff. A header timestamped before its parent is
+    // sent with its full time, so the offset is never negative.
+    if (nTime >= last_block.nTime && nTime - last_block.nTime <= uint32_t{std::numeric_limits<int16_t>::max()}) {
+        time_offset = static_cast<int16_t>(nTime - last_block.nTime);
         bit_field.MarkAsCompressed(CompressedHeaderBitField::Flag::TIMESTAMP);
     }
 

From b3304f5297159f701d822ddf0516c9bcf75681f5 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 28 Oct 2026 22:51:32 -0500
Subject: [PATCH 2/5] test: wait for index rewinds after invalidateblock in
 feature_timestampindex

The timestamp index removes disconnected blocks in its BlockDisconnected
validation callbacks. getblockhashes calls BlockUntilSyncedToCurrentChain,
which only drains the validation queue when the index is behind the tip.
After invalidateblock the index is ahead of the tip, so the RPC can run
before the callbacks and still return the invalidated blocks. develop's
ASan job already hit this once; any other work in the same callbacks
makes it more likely. Drain the validation queue before checking.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/functional/feature_timestampindex.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/test/functional/feature_timestampindex.py b/test/functional/feature_timestampindex.py
index 14111a7e4719..1769bc2ac2fb 100755
--- a/test/functional/feature_timestampindex.py
+++ b/test/functional/feature_timestampindex.py
@@ -55,6 +55,9 @@ def run_test(self):
         # Invalidate the last 2 blocks on both nodes
         self.nodes[0].invalidateblock(blockhashes[3])
         self.nodes[1].invalidateblock(blockhashes[3])
+        # The index removes the blocks in its BlockDisconnected callbacks. getblockhashes only waits for an index
+        # that is behind the tip, not for one that is ahead of it, so wait for the callbacks here.
+        self.nodes[1].syncwithvalidationinterfacequeue()
 
         # Verify that invalidated blocks are no longer in the index
         hashes_after_invalidate = self.nodes[1].getblockhashes(high, low)

From 6490d96331936806e3535dc360647cc6cc9955b1 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Tue, 13 Oct 2026 22:01:00 -0500
Subject: [PATCH 3/5] feat(index): add a governance proposal collateral index

Governance looks up proposal collateral through -txindex, which can't run
on a pruned node. Add GovCollateralIndex, a prune-compatible BaseIndex that
keeps a small summary of every transaction burning at least the proposal
fee: its block hash, whether all outputs are P2PKH or unspendable, and its
OP_RETURN <32-byte hash> burns. That is everything the collateral check
needs, so it keeps working after the blocks are pruned.

Governance will reach the index through governance::CollateralSource, a
small interface in governance/collateral.h, so that governance code doesn't
include the index and the index adds no include cycles through it.

The index registers its prune lock in CustomInit so that startup pruning
can't delete blocks it hasn't read yet. It is not wired into init or
governance yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/Makefile.am                          |   4 +
 src/Makefile.test.include                |   1 +
 src/governance/collateral.cpp            |  35 ++++++
 src/governance/collateral.h              |  50 ++++++++
 src/governance/object.h                  |   2 +-
 src/index/govcollateralindex.cpp         | 147 +++++++++++++++++++++++
 src/index/govcollateralindex.h           |  57 +++++++++
 src/test/governance_collateral_tests.cpp | 145 ++++++++++++++++++++++
 test/util/data/non-backported.txt        |   2 +
 9 files changed, 442 insertions(+), 1 deletion(-)
 create mode 100644 src/governance/collateral.cpp
 create mode 100644 src/governance/collateral.h
 create mode 100644 src/index/govcollateralindex.cpp
 create mode 100644 src/index/govcollateralindex.h
 create mode 100644 src/test/governance_collateral_tests.cpp

diff --git a/src/Makefile.am b/src/Makefile.am
index ad095c971a9f..117325f569f3 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -251,6 +251,7 @@ BITCOIN_CORE_H = \
   external_signer.h \
   flat-database.h \
   flatfile.h \
+  governance/collateral.h \
   governance/common.h \
   governance/governance.h \
   governance/net_governance.h \
@@ -271,6 +272,7 @@ BITCOIN_CORE_H = \
   index/blockfilterindex.h \
   index/coinstatsindex.h \
   index/disktxpos.h \
+  index/govcollateralindex.h \
   index/spentindex.h \
   index/spentindex_types.h \
   index/timestampindex.h \
@@ -574,6 +576,7 @@ libbitcoin_node_a_SOURCES = \
   evo/specialtx_filter.cpp \
   evo/specialtxman.cpp \
   flatfile.cpp \
+  governance/collateral.cpp \
   governance/governance.cpp \
   governance/net_governance.cpp \
   governance/object.cpp \
@@ -590,6 +593,7 @@ libbitcoin_node_a_SOURCES = \
   index/base.cpp \
   index/blockfilterindex.cpp \
   index/coinstatsindex.cpp \
+  index/govcollateralindex.cpp \
   index/spentindex.cpp \
   index/timestampindex.cpp \
   index/txindex.cpp \
diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index d59f65985291..7a180f80daa4 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -127,6 +127,7 @@ BITCOIN_TESTS =\
   test/flatfile_tests.cpp \
   test/fs_tests.cpp \
   test/getarg_tests.cpp \
+  test/governance_collateral_tests.cpp \
   test/governance_inv_tests.cpp \
   test/governance_superblock_tests.cpp \
   test/governance_validators_tests.cpp \
diff --git a/src/governance/collateral.cpp b/src/governance/collateral.cpp
new file mode 100644
index 000000000000..007275a9554f
--- /dev/null
+++ b/src/governance/collateral.cpp
@@ -0,0 +1,35 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <governance/collateral.h>
+
+#include <primitives/transaction.h>
+#include <script/script.h>
+#include <span.h>
+
+#include <algorithm>
+
+namespace governance {
+bool CollateralInfo::BurnsAtLeast(const uint256& hash, CAmount amount) const
+{
+    return std::any_of(burns.begin(), burns.end(),
+                       [&](const auto& burn) { return burn.first == hash && burn.second >= amount; });
+}
+
+CollateralInfo GetCollateralInfo(const CTransaction& tx, const uint256& block_hash)
+{
+    CollateralInfo info{block_hash, /*outputs_standard=*/true, /*burns=*/{}};
+    for (const auto& output : tx.vout) {
+        const CScript& script{output.scriptPubKey};
+        if (!script.IsPayToPublicKeyHash() && !script.IsUnspendable()) {
+            info.outputs_standard = false;
+        }
+        // Exactly the script `CScript() << OP_RETURN << ToByteVector(hash)` produces
+        if (script.size() == 2 + uint256::size() && script[0] == OP_RETURN && script[1] == uint256::size()) {
+            info.burns.emplace_back(uint256{Span{script}.subspan(2)}, output.nValue);
+        }
+    }
+    return info;
+}
+} // namespace governance
diff --git a/src/governance/collateral.h b/src/governance/collateral.h
new file mode 100644
index 000000000000..39d332d178cc
--- /dev/null
+++ b/src/governance/collateral.h
@@ -0,0 +1,50 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#ifndef BITCOIN_GOVERNANCE_COLLATERAL_H
+#define BITCOIN_GOVERNANCE_COLLATERAL_H
+
+#include <consensus/amount.h>
+#include <serialize.h>
+#include <uint256.h>
+
+#include <optional>
+#include <utility>
+#include <vector>
+
+class CTransaction;
+
+static constexpr CAmount GOVERNANCE_PROPOSAL_FEE_TX = (1 * COIN);
+
+namespace governance {
+/** The parts of a mined transaction that decide whether it is valid proposal collateral. */
+struct CollateralInfo {
+    uint256 block_hash;
+    //! Whether every output pays to P2PKH or is unspendable.
+    bool outputs_standard{false};
+    //! Value burned to each `OP_RETURN <32-byte hash>` output, together with that hash.
+    std::vector<std::pair<uint256, CAmount>> burns;
+
+    SERIALIZE_METHODS(CollateralInfo, obj) { READWRITE(obj.block_hash, obj.outputs_standard, obj.burns); }
+
+    bool BurnsAtLeast(const uint256& hash, CAmount amount) const;
+};
+
+CollateralInfo GetCollateralInfo(const CTransaction& tx, const uint256& block_hash);
+
+/** Where proposal collateral is looked up. Implemented by GovCollateralIndex. */
+class CollateralSource
+{
+public:
+    virtual ~CollateralSource() = default;
+
+    //! Whether every block up to the active tip has been read. Until then, a transaction that isn't
+    //! found may still be valid collateral.
+    virtual bool IsCollateralSynced() const = 0;
+
+    virtual std::optional<CollateralInfo> FindCollateral(const uint256& txid) const = 0;
+};
+} // namespace governance
+
+#endif // BITCOIN_GOVERNANCE_COLLATERAL_H
diff --git a/src/governance/object.h b/src/governance/object.h
index d1f516a995e7..68b55afa7272 100644
--- a/src/governance/object.h
+++ b/src/governance/object.h
@@ -5,6 +5,7 @@
 #ifndef BITCOIN_GOVERNANCE_OBJECT_H
 #define BITCOIN_GOVERNANCE_OBJECT_H
 
+#include <governance/collateral.h>
 #include <governance/common.h>
 #include <governance/vote.h>
 #include <governance/votedb.h>
@@ -84,7 +85,6 @@ class CGovernanceException : public std::exception
 };
 
 static constexpr double GOVERNANCE_FILTER_FP_RATE = 0.001;
-static constexpr CAmount GOVERNANCE_PROPOSAL_FEE_TX = (1 * COIN);
 static constexpr int64_t GOVERNANCE_FEE_CONFIRMATIONS = 6;
 static constexpr int64_t GOVERNANCE_MIN_RELAY_FEE_CONFIRMATIONS = 1;
 static constexpr std::chrono::hours GOVERNANCE_UPDATE_MIN{1};
diff --git a/src/index/govcollateralindex.cpp b/src/index/govcollateralindex.cpp
new file mode 100644
index 000000000000..cab00c694e1c
--- /dev/null
+++ b/src/index/govcollateralindex.cpp
@@ -0,0 +1,147 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <index/govcollateralindex.h>
+
+#include <chain.h>
+#include <chainparams.h>
+#include <logging.h>
+#include <node/blockstorage.h>
+#include <primitives/block.h>
+#include <util/system.h>
+#include <validation.h>
+
+#include <cassert>
+#include <vector>
+
+constexpr uint8_t DB_GOVCOLLATERAL{'g'};
+
+namespace {
+//! The transactions of a block that can pay for a proposal, with their collateral summaries
+std::vector<std::pair<uint256, governance::CollateralInfo>> GetCollaterals(const CBlock& block, const uint256& block_hash)
+{
+    std::vector<std::pair<uint256, governance::CollateralInfo>> collaterals;
+    for (const auto& tx : block.vtx) {
+        auto info{governance::GetCollateralInfo(*tx, block_hash)};
+        // Smaller burns can never pay for a proposal
+        std::erase_if(info.burns, [](const auto& burn) { return burn.second < GOVERNANCE_PROPOSAL_FEE_TX; });
+        if (!info.burns.empty()) {
+            collaterals.emplace_back(tx->GetHash(), std::move(info));
+        }
+    }
+    return collaterals;
+}
+} // namespace
+
+class GovCollateralIndex::DB : public BaseIndex::DB
+{
+public:
+    explicit DB(size_t n_cache_size, bool f_memory = false, bool f_wipe = false);
+
+    bool ReadCollateral(const uint256& txid, governance::CollateralInfo& info) const;
+
+    [[nodiscard]] bool WriteCollaterals(const std::vector<std::pair<uint256, governance::CollateralInfo>>& collaterals);
+
+    void EraseCollateral(CDBBatch& batch, const uint256& txid);
+};
+
+GovCollateralIndex::DB::DB(size_t n_cache_size, bool f_memory, bool f_wipe) :
+    BaseIndex::DB(gArgs.GetDataDirNet() / "indexes" / "govcollateralindex", n_cache_size, f_memory, f_wipe)
+{
+}
+
+bool GovCollateralIndex::DB::ReadCollateral(const uint256& txid, governance::CollateralInfo& info) const
+{
+    return Read(std::make_pair(DB_GOVCOLLATERAL, txid), info);
+}
+
+bool GovCollateralIndex::DB::WriteCollaterals(const std::vector<std::pair<uint256, governance::CollateralInfo>>& collaterals)
+{
+    CDBBatch batch(*this);
+    for (const auto& [txid, info] : collaterals) {
+        batch.Write(std::make_pair(DB_GOVCOLLATERAL, txid), info);
+    }
+    return WriteBatch(batch);
+}
+
+void GovCollateralIndex::DB::EraseCollateral(CDBBatch& batch, const uint256& txid)
+{
+    batch.Erase(std::make_pair(DB_GOVCOLLATERAL, txid));
+}
+
+GovCollateralIndex::GovCollateralIndex(std::unique_ptr<interfaces::Chain> chain, size_t n_cache_size, bool f_memory,
+                                       bool f_wipe) :
+    BaseIndex(std::move(chain), "govcollateralindex"),
+    m_db(std::make_unique<GovCollateralIndex::DB>(n_cache_size, f_memory, f_wipe))
+{
+}
+
+GovCollateralIndex::~GovCollateralIndex() = default;
+
+bool GovCollateralIndex::CustomInit(const std::optional<interfaces::BlockKey>& block)
+{
+    // BaseIndex only locks pruning once a new index has read its first block, so pruning at startup could
+    // still delete the blocks it is about to read.
+    if (!block) {
+        WITH_LOCK(::cs_main, m_chainstate->m_blockman.UpdatePruneLock(GetName(), node::PruneLockInfo{/*height_first=*/0}));
+    }
+    return true;
+}
+
+bool GovCollateralIndex::CustomAppend(const interfaces::BlockInfo& block)
+{
+    // Like the transaction index, leave out the genesis block, whose outputs are not spendable.
+    if (block.height == 0) return true;
+
+    assert(block.data);
+    const auto collaterals{GetCollaterals(*block.data, block.hash)};
+    return collaterals.empty() || m_db->WriteCollaterals(collaterals);
+}
+
+bool GovCollateralIndex::CustomRewind(const interfaces::BlockKey& current_tip, const interfaces::BlockKey& new_tip)
+{
+    // Otherwise burns in blocks that were reorged away would stay in the index for good. They are erased in the
+    // same batch that moves the best block back: erased first on their own, a crash in between would leave the
+    // index claiming blocks whose collaterals are gone, and it would never index them again.
+    CDBBatch batch(*m_db);
+    const CBlockIndex* new_tip_index{WITH_LOCK(::cs_main, return m_chainstate->m_blockman.LookupBlockIndex(new_tip.hash))};
+    for (const CBlockIndex* pindex{WITH_LOCK(::cs_main, return m_chainstate->m_blockman.LookupBlockIndex(current_tip.hash))};
+         pindex != new_tip_index; pindex = pindex->pprev) {
+        CBlock block;
+        if (!node::ReadBlockFromDisk(block, pindex, Params().GetConsensus())) {
+            LogError("%s: Failed to read block %s from disk\n", __func__, pindex->GetBlockHash().ToString());
+            return false;
+        }
+        for (const auto& [txid, _] : GetCollaterals(block, pindex->GetBlockHash())) {
+            m_db->EraseCollateral(batch, txid);
+        }
+    }
+    m_db->WriteBestBlock(batch, GetLocator(new_tip_index));
+    return m_db->WriteBatch(batch);
+}
+
+BaseIndex::DB& GovCollateralIndex::GetDB() const { return *m_db; }
+
+bool GovCollateralIndex::CanSync(Chainstate& chainstate) const
+{
+    AssertLockHeld(::cs_main);
+    CBlockLocator locator;
+    const CBlockIndex* best_block{nullptr};
+    if (m_db->ReadBestBlock(locator) && !locator.IsNull()) {
+        best_block = chainstate.FindForkInGlobalIndex(locator);
+    }
+    for (const CBlockIndex* block{chainstate.m_chain.Tip()}; block != best_block; block = block->pprev) {
+        if (!(block->nStatus & BLOCK_HAVE_DATA)) return false;
+    }
+    return true;
+}
+
+bool GovCollateralIndex::IsCollateralSynced() const { return GetSummary().synced; }
+
+std::optional<governance::CollateralInfo> GovCollateralIndex::FindCollateral(const uint256& txid) const
+{
+    governance::CollateralInfo info;
+    if (!m_db->ReadCollateral(txid, info)) return std::nullopt;
+    return info;
+}
diff --git a/src/index/govcollateralindex.h b/src/index/govcollateralindex.h
new file mode 100644
index 000000000000..d7bfddb83159
--- /dev/null
+++ b/src/index/govcollateralindex.h
@@ -0,0 +1,57 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#ifndef BITCOIN_INDEX_GOVCOLLATERALINDEX_H
+#define BITCOIN_INDEX_GOVCOLLATERALINDEX_H
+
+#include <governance/collateral.h>
+#include <index/base.h>
+
+#include <optional>
+
+class Chainstate;
+
+/**
+ * GovCollateralIndex records every transaction that burns at least the proposal fee to an
+ * `OP_RETURN <32-byte hash>` output, i.e. everything that could be a governance proposal's
+ * collateral. Unlike the transaction index it stores what the collateral check needs rather
+ * than a position in the block files, so it keeps working after those blocks are pruned.
+ *
+ * The index is written to a LevelDB database at <datadir>/indexes/govcollateralindex/
+ */
+class GovCollateralIndex final : public BaseIndex, public governance::CollateralSource
+{
+protected:
+    class DB;
+
+private:
+    const std::unique_ptr<DB> m_db;
+
+    bool AllowPrune() const override { return true; }
+
+protected:
+    bool CustomInit(const std::optional<interfaces::BlockKey>& block) override;
+
+    bool CustomAppend(const interfaces::BlockInfo& block) override;
+
+    bool CustomRewind(const interfaces::BlockKey& current_tip, const interfaces::BlockKey& new_tip) override;
+
+    BaseIndex::DB& GetDB() const override;
+
+public:
+    explicit GovCollateralIndex(std::unique_ptr<interfaces::Chain> chain, size_t n_cache_size, bool f_memory = false,
+                                bool f_wipe = false);
+
+    // Destructor is declared because this class contains a unique_ptr to an incomplete type.
+    virtual ~GovCollateralIndex() override;
+
+    /// Whether the blocks the index still has to read are stored, i.e. whether Start() would succeed.
+    bool CanSync(Chainstate& chainstate) const EXCLUSIVE_LOCKS_REQUIRED(::cs_main);
+
+    bool IsCollateralSynced() const override;
+
+    std::optional<governance::CollateralInfo> FindCollateral(const uint256& txid) const override;
+};
+
+#endif // BITCOIN_INDEX_GOVCOLLATERALINDEX_H
diff --git a/src/test/governance_collateral_tests.cpp b/src/test/governance_collateral_tests.cpp
new file mode 100644
index 000000000000..880e7e873044
--- /dev/null
+++ b/src/test/governance_collateral_tests.cpp
@@ -0,0 +1,145 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <consensus/validation.h>
+#include <governance/collateral.h>
+#include <index/govcollateralindex.h>
+#include <interfaces/chain.h>
+#include <key.h>
+#include <primitives/transaction.h>
+#include <script/standard.h>
+#include <util/strencodings.h>
+#include <validation.h>
+#include <validationinterface.h>
+
+#include <test/util/index.h>
+#include <test/util/masternode.h>
+#include <test/util/setup_common.h>
+
+#include <boost/test/unit_test.hpp>
+
+#include <memory>
+#include <string>
+#include <vector>
+
+namespace {
+CScript BurnScript(const uint256& hash) { return CScript() << OP_RETURN << ToByteVector(hash); }
+
+struct CollateralSetup : public TestChain100Setup {
+    std::unique_ptr<GovCollateralIndex> index;
+    SimpleUTXOMap utxos;
+
+    CollateralSetup()
+    {
+        // Matures a few coinbases so the burns below can be funded
+        for (int i = 0; i < 5; ++i) {
+            MineBlock({});
+        }
+        utxos = BuildSimpleUtxoMap(m_coinbase_txns);
+    }
+
+    ~CollateralSetup()
+    {
+        SyncWithValidationInterfaceQueue();
+        if (index) index->Stop();
+    }
+
+    CScript ChangeScript() const { return GetScriptForDestination(PKHash(coinbaseKey.GetPubKey())); }
+
+    CBlock MineBlock(const std::vector<CMutableTransaction>& txns)
+    {
+        return CreateAndProcessBlock(txns, GetScriptForRawPubKey(coinbaseKey.GetPubKey()));
+    }
+
+    CMutableTransaction MakeBurn(const uint256& hash, CAmount amount, const std::vector<CTxOut>& extra_outputs = {})
+    {
+        CMutableTransaction tx;
+        const auto spent{FundTransaction(*m_node.chainman, tx, utxos, BurnScript(hash), amount, ChangeScript())};
+        tx.vout.insert(tx.vout.end(), extra_outputs.begin(), extra_outputs.end());
+        SignTransaction(tx, spent, coinbaseKey);
+        return tx;
+    }
+
+    void StartIndex()
+    {
+        // A block notification still queued from MineBlock would reach the index after it synced past that block
+        SyncWithValidationInterfaceQueue();
+        index = std::make_unique<GovCollateralIndex>(interfaces::MakeChain(m_node), /*n_cache_size=*/0, /*f_memory=*/true);
+        BOOST_REQUIRE(index->Start());
+        IndexWaitSynced(*index);
+    }
+};
+} // namespace
+
+BOOST_FIXTURE_TEST_SUITE(governance_collateral_tests, BasicTestingSetup)
+
+BOOST_AUTO_TEST_CASE(collateral_info_counts_only_exact_burn_scripts)
+{
+    const uint256 hash{uint256S("aa")};
+    const uint256 other_hash{uint256S("bb")};
+    std::vector<unsigned char> short_payload(31, 0xcc);
+
+    CMutableTransaction tx;
+    tx.vout.emplace_back(COIN, GetScriptForDestination(PKHash(uint160{})));
+    tx.vout.emplace_back(2 * COIN, BurnScript(hash));
+    tx.vout.emplace_back(3 * COIN, CScript() << OP_RETURN << short_payload);
+    // As long as a 32-byte burn, but pushed with OP_PUSHDATA1
+    CScript pushdata_burn;
+    pushdata_burn << OP_RETURN << OP_PUSHDATA1;
+    pushdata_burn.push_back(31);
+    pushdata_burn.insert(pushdata_burn.end(), other_hash.begin(), other_hash.end() - 1);
+    BOOST_REQUIRE_EQUAL(pushdata_burn.size(), BurnScript(other_hash).size());
+    tx.vout.emplace_back(4 * COIN, pushdata_burn);
+
+    const uint256 block_hash{uint256S("01")};
+    const auto info{governance::GetCollateralInfo(CTransaction{tx}, block_hash)};
+    BOOST_CHECK(info.block_hash == block_hash);
+    BOOST_CHECK(info.outputs_standard);
+    BOOST_REQUIRE_EQUAL(info.burns.size(), 1U);
+    BOOST_CHECK(info.BurnsAtLeast(hash, 2 * COIN));
+    BOOST_CHECK(!info.BurnsAtLeast(hash, 2 * COIN + 1));
+    BOOST_CHECK(!info.BurnsAtLeast(other_hash, 1));
+
+    tx.vout.emplace_back(COIN, GetScriptForDestination(ScriptHash(uint160{})));
+    BOOST_CHECK(!governance::GetCollateralInfo(CTransaction{tx}, block_hash).outputs_standard);
+}
+
+BOOST_FIXTURE_TEST_CASE(index_records_transactions_burning_the_proposal_fee, CollateralSetup)
+{
+    const uint256 fee_hash{uint256S("aa")};
+    const uint256 short_hash{uint256S("bb")};
+    // Its smaller burn can never pay for a proposal, so the index leaves it out
+    const auto fee_burn{MakeBurn(fee_hash, GOVERNANCE_PROPOSAL_FEE_TX, {CTxOut{0, BurnScript(short_hash)}})};
+    const auto short_burn{MakeBurn(short_hash, GOVERNANCE_PROPOSAL_FEE_TX - 1)};
+    const CBlock block{MineBlock({fee_burn, short_burn})};
+
+    // Blocks connected before the index started
+    StartIndex();
+    const auto collateral{index->FindCollateral(fee_burn.GetHash())};
+    BOOST_REQUIRE(collateral);
+    BOOST_CHECK(collateral->block_hash == block.GetHash());
+    BOOST_CHECK(collateral->outputs_standard);
+    BOOST_CHECK(collateral->BurnsAtLeast(fee_hash, GOVERNANCE_PROPOSAL_FEE_TX));
+    BOOST_CHECK_EQUAL(collateral->burns.size(), 1U);
+    BOOST_CHECK(!index->FindCollateral(short_burn.GetHash()));
+    BOOST_CHECK(!index->FindCollateral(block.vtx[0]->GetHash()));
+
+    // Blocks connected while the index is running
+    const auto later_burn{MakeBurn(uint256S("cc"), GOVERNANCE_PROPOSAL_FEE_TX)};
+    const CBlock later_block{MineBlock({later_burn})};
+    BOOST_REQUIRE(index->BlockUntilSyncedToCurrentChain());
+    const auto later_collateral{index->FindCollateral(later_burn.GetHash())};
+    BOOST_REQUIRE(later_collateral);
+    BOOST_CHECK(later_collateral->block_hash == later_block.GetHash());
+
+    // Blocks reorged away
+    BlockValidationState state;
+    m_node.chainman->ActiveChainstate().InvalidateBlock(state, WITH_LOCK(::cs_main, return m_node.chainman->ActiveChain().Tip()));
+    MineBlock({});
+    BOOST_REQUIRE(index->BlockUntilSyncedToCurrentChain());
+    BOOST_CHECK(!index->FindCollateral(later_burn.GetHash()));
+    BOOST_CHECK(index->FindCollateral(fee_burn.GetHash()));
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/test/util/data/non-backported.txt b/test/util/data/non-backported.txt
index 776d03b21d54..19db26c1ce8f 100644
--- a/test/util/data/non-backported.txt
+++ b/test/util/data/non-backported.txt
@@ -22,6 +22,8 @@ src/governance/*.cpp
 src/governance/*.h
 src/index/address*.cpp
 src/index/address*.h
+src/index/govcollateral*.cpp
+src/index/govcollateral*.h
 src/index/spent*.cpp
 src/index/spent*.h
 src/index/timestamp*.cpp

From 8229bf6a9086363f11ecde3f01fa8f0098848517 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Tue, 13 Oct 2026 22:01:46 -0500
Subject: [PATCH 4/5] feat(governance): run governance on pruned nodes

-prune soft-disabled governance because proposal collateral could only be
found through -txindex. Look collateral up only in the governance
collateral index instead, which every node now runs. The index lives in
NodeContext and CGovernanceManager gets it as a governance::CollateralSource,
so governance no longer depends on -txindex at all. -prune no longer
soft-sets -disablegovernance, and Qt no longer forces it.

Pruned nodes with governance now sync proposals and votes, can create and
submit proposals, and validate superblock payments in full instead of only
checking that they stay within the budget.

While the index is still catching up, governance P2P messages are ignored
and the governance sync stage waits instead of timing out, so peers are
not punished for objects that only fail because the index lags.
Announcements received meanwhile are held per peer and requested from
the announcing peer once the index has synced: the peer won't announce
them again, and its sync response skips what it already announced. A node
that pruned blocks before it had the index can't build it; it now starts
with governance off and a warning to -reindex once, instead of failing in
BaseIndex::Init.

The pruned-node scenarios are covered by making one of the nodes in
feature_governance.py pruned. feature_governance_txindex_devnet.py tested
the -txindex requirement, which is gone, so it is removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 doc/files.md                                  |   1 +
 doc/release-notes-7860.md                     |  33 +++++
 src/governance/governance.cpp                 |  16 +-
 src/governance/governance.h                   |   8 +-
 src/governance/net_governance.cpp             |  17 ++-
 src/governance/net_governance.h               |   1 +
 src/governance/object.cpp                     |  92 ++++++------
 src/governance/object.h                       |  15 +-
 src/governance/signing.cpp                    |   3 +-
 src/init.cpp                                  |  51 ++++---
 src/net_processing.cpp                        |  53 ++++++-
 src/net_processing.h                          |   6 +
 src/node/context.cpp                          |   1 +
 src/node/context.h                            |   2 +
 src/node/interfaces.cpp                       |   8 +-
 src/node/sync_manager.cpp                     |   5 +
 src/qt/optionsmodel.cpp                       |   3 +-
 src/rpc/governance.cpp                        |  42 +++---
 src/rpc/node.cpp                              |   5 +
 src/test/governance_collateral_tests.cpp      |  64 +++++++-
 src/test/governance_inv_tests.cpp             | 117 ++++++++++++++-
 src/test/governance_vote_processing_tests.cpp |  29 ++--
 test/functional/feature_governance.py         | 138 ++++++++++++++++--
 .../feature_governance_txindex_devnet.py      |  35 -----
 test/functional/feature_index_prune.py        |  34 +++--
 test/functional/feature_pruning.py            |  36 ++---
 .../feature_remove_pruned_files_on_startup.py |   5 +-
 test/functional/interface_rest.py             |   1 +
 test/functional/interface_usdt_utxocache.py   |   3 +-
 test/functional/p2p_dos_header_tree.py        |   5 +-
 test/functional/p2p_node_network_limited.py   |   3 +-
 test/functional/rpc_blockchain.py             |   9 +-
 test/functional/rpc_getblockfrompeer.py       |   5 +-
 test/functional/rpc_misc.py                   |   7 +-
 test/functional/rpc_rawtransaction.py         |   3 +-
 test/functional/test_framework/governance.py  |   5 +-
 test/functional/test_runner.py                |   1 -
 test/functional/wallet_crosschain.py          |   5 +-
 test/functional/wallet_pruning.py             |   3 +-
 test/lint/lint-circular-dependencies.py       |   1 +
 40 files changed, 619 insertions(+), 252 deletions(-)
 create mode 100644 doc/release-notes-7860.md
 delete mode 100755 test/functional/feature_governance_txindex_devnet.py

diff --git a/doc/files.md b/doc/files.md
index 98a358a9394e..4f655a672471 100644
--- a/doc/files.md
+++ b/doc/files.md
@@ -54,6 +54,7 @@ Subdirectory       | File(s)               | Description
 `indexes/blockfilter/basic/db/` | LevelDB database      | Blockfilter index LevelDB database for the basic filtertype; *optional*, used if `-blockfilterindex=basic`
 `indexes/blockfilter/basic/`    | `fltrNNNNN.dat`<sup>[\[2\]](#note2)</sup> | Blockfilter index filters for the basic filtertype; *optional*, used if `-blockfilterindex=basic`
 `indexes/coinstats/db/` | LevelDB database | Coinstats index; *optional*, used if `-coinstatsindex=1`
+`indexes/govcollateralindex/` | LevelDB database | Governance proposal collateral index
 `wallets/`         |                       | [Contains wallets](#multi-wallet-environment); can be specified by `-walletdir` option; if `wallets/` subdirectory does not exist, wallets reside in the [data directory](#data-directory-location)
 `./`               | `anchors.dat`         | Anchor IP address database, created on shutdown and deleted at startup. Anchors are last known outgoing block-relay-only peers that are tried to re-connect to on startup
 `evodb/`         |                       |special txes and quorums database
diff --git a/doc/release-notes-7860.md b/doc/release-notes-7860.md
new file mode 100644
index 000000000000..08fec1963c9b
--- /dev/null
+++ b/doc/release-notes-7860.md
@@ -0,0 +1,33 @@
+Governance
+----------
+
+- Pruned nodes can now run governance. Proposal collateral is now looked up
+  in a new governance collateral index instead of `-txindex`. The index
+  stores only the transactions that could be a proposal's collateral, works
+  with `-prune`, and always runs; there is no option for it. Pruned nodes, and
+  nodes started with `-txindex=0`, now sync proposals and votes, check
+  superblock payments in full, and can create and submit proposals.
+
+- Every node builds the index once, on the first start after upgrading. It
+  reads every block for that, and the node's governance sync waits until it
+  has finished.
+
+- A node that pruned blocks before it had this index can't build it, because
+  the index has to start from the genesis block. It now starts with governance
+  turned off and a warning instead of failing; restarting it once with
+  `-reindex` downloads the blockchain again and enables governance, and the
+  node stays pruned. This replaces the warning such nodes showed before, that
+  governance is disabled because the node is pruned.
+
+- Dash-Qt used to save `disablegovernance=1` in `settings.json` when pruning
+  was turned on in the options. That setting stays until it is removed, so
+  governance stays off on those nodes.
+
+- Pruned nodes now check superblock payments against the governance
+  triggers they know, like full nodes do, instead of only checking that a
+  superblock stays within the budget.
+
+- `getindexinfo` reports the new index as `govcollateralindex`.
+
+- Starting with `-prune` and `-disablegovernance=0` is no longer an error.
+  Governance validation no longer needs `-txindex`.
diff --git a/src/governance/governance.cpp b/src/governance/governance.cpp
index e4d792f122b4..f64fda4accc5 100644
--- a/src/governance/governance.cpp
+++ b/src/governance/governance.cpp
@@ -73,18 +73,24 @@ GovernanceStore::GovernanceStore() :
 
 CGovernanceManager::CGovernanceManager(CMasternodeMetaMan& mn_metaman, const ChainstateManager& chainman,
                                        governance::SuperblockManager& superblocks, CDeterministicMNManager& dmnman,
-                                       CMasternodeSync& mn_sync) :
+                                       CMasternodeSync& mn_sync, const governance::CollateralSource* collateral) :
     m_db{std::make_unique<db_type>("governance.dat", "magicGovernanceCache")},
     m_mn_metaman{mn_metaman},
     m_chainman{chainman},
     m_superblocks{superblocks},
     m_dmnman{dmnman},
     m_mn_sync{mn_sync},
+    m_collateral{collateral},
     cmapVoteToObject{MAX_CACHE_SIZE},
     mapPostponedObjects{}
 {
 }
 
+bool CGovernanceManager::IsCollateralSourceBehind() const
+{
+    return m_collateral && !m_collateral->IsCollateralSynced();
+}
+
 CGovernanceManager::~CGovernanceManager()
 {
     // Reset the paired SuperblockManager so its loaded-flag and trigger map don't
@@ -248,7 +254,7 @@ bool CGovernanceManager::ProcessObject(const std::string& peer_str, const uint25
 
     const auto tip_mn_list = m_dmnman.GetListAtChainTip();
     bool fMissingConfirmations = false;
-    bool fIsValid = govobj.IsValidLocally(tip_mn_list, m_chainman, strError, fMissingConfirmations, true);
+    bool fIsValid = govobj.IsValidLocally(tip_mn_list, m_chainman, m_collateral, strError, fMissingConfirmations, true);
 
     bool unused_rcb;
     if (fRateCheckBypassed && fIsValid && !MasternodeRateCheck(govobj, true, true, unused_rcb)) {
@@ -322,7 +328,7 @@ void CGovernanceManager::AddGovernanceObjectInternal(CGovernanceObject& insert_o
 
     // MAKE SURE THIS OBJECT IS OK
 
-    if (!insert_obj.IsValidLocally(tip_mn_list, m_chainman, strError, true)) {
+    if (!insert_obj.IsValidLocally(tip_mn_list, m_chainman, m_collateral, strError, true)) {
         LogPrint(BCLog::GOBJECT, "CGovernanceManager::AddGovernanceObject -- invalid governance object - %s - (nCachedBlockHeight %d) \n", strError, nCachedBlockHeight);
         return;
     }
@@ -874,8 +880,8 @@ void CGovernanceManager::CheckPostponedObjects()
 
         std::string strError;
         bool fMissingConfirmations;
-        if (govobj.IsCollateralValid(m_chainman, strError, fMissingConfirmations)) {
-            if (govobj.IsValidLocally(m_dmnman.GetListAtChainTip(), m_chainman, strError, false)) {
+        if (govobj.IsCollateralValid(m_collateral, m_chainman, strError, fMissingConfirmations)) {
+            if (govobj.IsValidLocally(m_dmnman.GetListAtChainTip(), m_chainman, /*collateral=*/nullptr, strError, false)) {
                 AddGovernanceObjectInternal(govobj, "<postponed>");
             } else {
                 LogPrint(BCLog::GOBJECT, "CGovernanceManager::CheckPostponedObjects -- %s invalid\n", nHash.ToString());
diff --git a/src/governance/governance.h b/src/governance/governance.h
index 7d858930e967..26a7ef2b3085 100644
--- a/src/governance/governance.h
+++ b/src/governance/governance.h
@@ -38,6 +38,7 @@ struct RPCResult;
 class UniValue;
 
 namespace governance {
+class CollateralSource;
 class SuperblockManager;
 
 struct OrphanVote {
@@ -254,6 +255,8 @@ class CGovernanceManager : public GovernanceStore
     governance::SuperblockManager& m_superblocks;
     CDeterministicMNManager& m_dmnman;
     CMasternodeSync& m_mn_sync;
+    //! Null on a node that can't look up proposal collateral
+    const governance::CollateralSource* const m_collateral;
 
     int64_t nTimeLastDiff{0};
     // keep track of current block height
@@ -272,11 +275,14 @@ class CGovernanceManager : public GovernanceStore
     CGovernanceManager& operator=(const CGovernanceManager&) = delete;
     explicit CGovernanceManager(CMasternodeMetaMan& mn_metaman, const ChainstateManager& chainman,
                                 governance::SuperblockManager& superblocks, CDeterministicMNManager& dmnman,
-                                CMasternodeSync& mn_sync);
+                                CMasternodeSync& mn_sync, const governance::CollateralSource* collateral);
     ~CGovernanceManager();
 
     // Basic initialization and querying
     bool IsValid() const { return is_loaded; }
+    const governance::CollateralSource* GetCollateralSource() const { return m_collateral; }
+    //! Whether proposal collateral can't be checked yet because the collateral source is still catching up
+    bool IsCollateralSourceBehind() const;
     bool LoadCache(bool load_cache)
         EXCLUSIVE_LOCKS_REQUIRED(!cs_store);
     [[nodiscard]] static RPCResult GetJsonHelp(const std::string& key, bool optional);
diff --git a/src/governance/net_governance.cpp b/src/governance/net_governance.cpp
index 56d193d9ad62..4fd4d898468a 100644
--- a/src/governance/net_governance.cpp
+++ b/src/governance/net_governance.cpp
@@ -80,6 +80,8 @@ void NetGovernance::Schedule(CScheduler& scheduler)
 void NetGovernance::ProcessMessage(CNode& peer, const std::string& msg_type, CDataStream& vRecv)
 {
     if (!m_gov_manager.IsValid()) return;
+    // Until proposal collateral can be looked up, valid proposals would look invalid and their senders get punished
+    if (m_gov_manager.IsCollateralSourceBehind()) return;
     if (!m_node_sync.IsBlockchainSynced()) return;
 
     // ANOTHER USER IS ASKING US TO HELP THEM SYNC GOVERNANCE OBJECT DATA
@@ -275,12 +277,21 @@ bool NetGovernance::AlreadyHave(const CInv& inv)
     if (inv.type != MSG_GOVERNANCE_OBJECT && inv.type != MSG_GOVERNANCE_OBJECT_VOTE) {
         return false;
     }
-    // When governance isn't loaded (e.g. -disablegovernance), claim we already have
-    // the item so we don't fetch or track it in the net-layer request tracker.
-    if (!m_gov_manager.IsValid()) return true;
+    // When governance isn't loaded (e.g. -disablegovernance) or can't check collateral yet, claim we
+    // already have the item so we don't fetch or track it in the net-layer request tracker.
+    if (!m_gov_manager.IsValid() || m_gov_manager.IsCollateralSourceBehind()) return true;
     return !m_gov_manager.ConfirmInventoryRequest(inv);
 }
 
+bool NetGovernance::DeferAnnouncement(const CInv& inv)
+{
+    if (inv.type != MSG_GOVERNANCE_OBJECT && inv.type != MSG_GOVERNANCE_OBJECT_VOTE) {
+        return false;
+    }
+    // Hold exactly the announcements ProcessMessage() would drop the objects of
+    return m_gov_manager.IsValid() && (m_gov_manager.IsCollateralSourceBehind() || !m_node_sync.IsBlockchainSynced());
+}
+
 bool NetGovernance::ProcessGetData(CNode& pfrom, const CInv& inv, const CNetMsgMaker& msgMaker)
 {
     if (inv.type == MSG_GOVERNANCE_OBJECT) {
diff --git a/src/governance/net_governance.h b/src/governance/net_governance.h
index c6975af44f5c..de9e3807413b 100644
--- a/src/governance/net_governance.h
+++ b/src/governance/net_governance.h
@@ -28,6 +28,7 @@ class NetGovernance final : public NetHandler
     void ProcessMessage(CNode& peer, const std::string& msg_type, CDataStream& vRecv) override;
 
     bool AlreadyHave(const CInv& inv) override;
+    bool DeferAnnouncement(const CInv& inv) override;
     bool ProcessGetData(CNode& pfrom, const CInv& inv, const CNetMsgMaker& msgMaker) override;
 
 private:
diff --git a/src/governance/object.cpp b/src/governance/object.cpp
index 9db728eeb243..619342bce588 100644
--- a/src/governance/object.cpp
+++ b/src/governance/object.cpp
@@ -10,12 +10,12 @@
 #include <masternode/sync.h>
 
 #include <chainparams.h>
-#include <index/txindex.h>
 #include <key_io.h>
 #include <logging.h>
 #include <node/interface_ui.h>
 #include <timedata.h>
 #include <tinyformat.h>
+#include <util/moneystr.h>
 #include <util/std23.h>
 #include <util/strencodings.h>
 #include <util/time.h>
@@ -597,7 +597,8 @@ UniValue CGovernanceObject::GetStateJson(const ChainstateManager& chainman, cons
         ret.pushKV("SigningMasternode", outpoint.ToStringShort());
     }
     std::string strError;
-    ret.pushKV(local_valid_key, WITH_LOCK(::cs_main, return IsValidLocally(tip_mn_list, chainman, strError, /*fCheckCollateral=*/false)));
+    ret.pushKV(local_valid_key, WITH_LOCK(::cs_main, return IsValidLocally(tip_mn_list, chainman, /*collateral=*/nullptr,
+                                                                           strError, /*fCheckCollateral=*/false)));
     ret.pushKV("IsValidReason", strError.c_str());
     LOCK(cs);
     ret.pushKV("fCachedValid", fCachedValid);
@@ -689,18 +690,22 @@ void CGovernanceObject::UpdateLocalValidity(const CDeterministicMNList& tip_mn_l
 {
     AssertLockHeld(::cs_main);
     // THIS DOES NOT CHECK COLLATERAL, THIS IS CHECKED UPON ORIGINAL ARRIVAL
-    fCachedLocalValidity = IsValidLocally(tip_mn_list, chainman, strLocalValidityError, false);
+    fCachedLocalValidity = IsValidLocally(tip_mn_list, chainman, /*collateral=*/nullptr, strLocalValidityError, false);
 }
 
 
-bool CGovernanceObject::IsValidLocally(const CDeterministicMNList& tip_mn_list, const ChainstateManager& chainman, std::string& strError, bool fCheckCollateral) const
+bool CGovernanceObject::IsValidLocally(const CDeterministicMNList& tip_mn_list, const ChainstateManager& chainman,
+                                       const governance::CollateralSource* collateral, std::string& strError,
+                                       bool fCheckCollateral) const
 {
     bool fMissingConfirmations = false;
 
-    return IsValidLocally(tip_mn_list, chainman, strError, fMissingConfirmations, fCheckCollateral);
+    return IsValidLocally(tip_mn_list, chainman, collateral, strError, fMissingConfirmations, fCheckCollateral);
 }
 
-bool CGovernanceObject::IsValidLocally(const CDeterministicMNList& tip_mn_list, const ChainstateManager& chainman, std::string& strError, bool& fMissingConfirmations, bool fCheckCollateral) const
+bool CGovernanceObject::IsValidLocally(const CDeterministicMNList& tip_mn_list, const ChainstateManager& chainman,
+                                       const governance::CollateralSource* collateral, std::string& strError,
+                                       bool& fMissingConfirmations, bool fCheckCollateral) const
 {
     AssertLockHeld(::cs_main);
 
@@ -721,7 +726,7 @@ bool CGovernanceObject::IsValidLocally(const CDeterministicMNList& tip_mn_list,
             strError = strprintf("Invalid proposal data, error messages: %s", strValidationError);
             return false;
         }
-        if (fCheckCollateral && !IsCollateralValid(chainman, strError, fMissingConfirmations)) {
+        if (fCheckCollateral && !IsCollateralValid(collateral, chainman, strError, fMissingConfirmations)) {
             strError = "Invalid proposal collateral";
             return false;
         }
@@ -771,7 +776,28 @@ CAmount CGovernanceObject::GetMinCollateralFee() const
     }
 }
 
-bool CGovernanceObject::IsCollateralValid(const ChainstateManager& chainman, std::string& strError, bool& fMissingConfirmations) const
+namespace {
+std::optional<governance::CollateralInfo> FindCollateral(const governance::CollateralSource* source,
+                                                         const uint256& txid, std::string& strError)
+{
+    if (!source) {
+        strError = "Can't look up collateral, the governance collateral index isn't running";
+        return std::nullopt;
+    }
+    if (!source->IsCollateralSynced()) {
+        strError = "Can't look up collateral until the governance collateral index has synced";
+        return std::nullopt;
+    }
+    auto collateral{source->FindCollateral(txid)};
+    if (!collateral) {
+        strError = strprintf("Can't find collateral tx %s", txid.ToString());
+    }
+    return collateral;
+}
+} // anonymous namespace
+
+bool CGovernanceObject::IsCollateralValid(const governance::CollateralSource* source, const ChainstateManager& chainman,
+                                          std::string& strError, bool& fMissingConfirmations) const
 {
     AssertLockHeld(::cs_main);
 
@@ -779,56 +805,26 @@ bool CGovernanceObject::IsCollateralValid(const ChainstateManager& chainman, std
     fMissingConfirmations = false;
     uint256 nExpectedHash = GetHash();
 
-    CTransactionRef txCollateral;
-    uint256 nBlockHash;
-    if (g_txindex) {
-        g_txindex->FindTx(m_obj.collateralHash, nBlockHash, txCollateral);
-    }
-
-    if (!txCollateral) {
-        strError = strprintf("Can't find collateral tx %s", m_obj.collateralHash.ToString());
+    const std::optional<governance::CollateralInfo> collateral{FindCollateral(source, m_obj.collateralHash, strError)};
+    if (!collateral) {
         LogPrintf("CGovernanceObject::IsCollateralValid -- %s\n", strError);
         return false;
     }
+    const uint256& nBlockHash{collateral->block_hash};
 
-    if (nBlockHash == uint256()) {
-        strError = strprintf("Collateral tx %s is not mined yet", txCollateral->ToString());
-        LogPrintf("CGovernanceObject::IsCollateralValid -- %s\n", strError);
-        return false;
-    }
-
-    if (txCollateral->vout.empty()) {
-        strError = "tx vout is empty";
+    if (!collateral->outputs_standard) {
+        strError = strprintf("Invalid Script in collateral tx %s, outputs must be P2PKH or unspendable",
+                             m_obj.collateralHash.ToString());
         LogPrintf("CGovernanceObject::IsCollateralValid -- %s\n", strError);
         return false;
     }
 
     // LOOK FOR SPECIALIZED GOVERNANCE SCRIPT (PROOF OF BURN)
 
-    CScript findScript;
-    findScript << OP_RETURN << ToByteVector(nExpectedHash);
-
-    CAmount nMinFee = GetMinCollateralFee();
-
-    LogPrint(BCLog::GOBJECT, "CGovernanceObject::IsCollateralValid -- txCollateral->vout.size() = %s, findScript = %s, nMinFee = %lld\n",
-                txCollateral->vout.size(), HexStr(findScript), nMinFee);
-
-    bool foundOpReturn = false;
-    for (const auto& output : txCollateral->vout) {
-        LogPrint(BCLog::GOBJECT, "CGovernanceObject::IsCollateralValid -- txout = %s, output.nValue = %lld, output.scriptPubKey = %s\n",
-                    output.ToString(), output.nValue, HexStr(output.scriptPubKey));
-        if (!output.scriptPubKey.IsPayToPublicKeyHash() && !output.scriptPubKey.IsUnspendable()) {
-            strError = strprintf("Invalid Script %s", txCollateral->ToString());
-            LogPrintf("CGovernanceObject::IsCollateralValid -- %s\n", strError);
-            return false;
-        }
-        if (output.scriptPubKey == findScript && output.nValue >= nMinFee) {
-            foundOpReturn = true;
-        }
-    }
-
-    if (!foundOpReturn) {
-        strError = strprintf("Couldn't find opReturn %s in %s", nExpectedHash.ToString(), txCollateral->ToString());
+    const CAmount nMinFee = GetMinCollateralFee();
+    if (!collateral->BurnsAtLeast(nExpectedHash, nMinFee)) {
+        strError = strprintf("Couldn't find opReturn %s burning at least %s in collateral tx %s",
+                             nExpectedHash.ToString(), FormatMoney(nMinFee), m_obj.collateralHash.ToString());
         LogPrintf("CGovernanceObject::IsCollateralValid -- %s\n", strError);
         return false;
     }
diff --git a/src/governance/object.h b/src/governance/object.h
index 68b55afa7272..841d88be2c4f 100644
--- a/src/governance/object.h
+++ b/src/governance/object.h
@@ -232,15 +232,18 @@ class CGovernanceObject
 
     // CORE OBJECT FUNCTIONS
 
-    bool IsValidLocally(const CDeterministicMNList& tip_mn_list, const ChainstateManager& chainman, std::string& strError, bool fCheckCollateral) const
-        EXCLUSIVE_LOCKS_REQUIRED(::cs_main);
+    /// `collateral` is where proposal collateral is looked up when `fCheckCollateral` is set
+    bool IsValidLocally(const CDeterministicMNList& tip_mn_list, const ChainstateManager& chainman,
+                        const governance::CollateralSource* collateral, std::string& strError,
+                        bool fCheckCollateral) const EXCLUSIVE_LOCKS_REQUIRED(::cs_main);
 
-    bool IsValidLocally(const CDeterministicMNList& tip_mn_list, const ChainstateManager& chainman, std::string& strError, bool& fMissingConfirmations, bool fCheckCollateral) const
-        EXCLUSIVE_LOCKS_REQUIRED(::cs_main);
+    bool IsValidLocally(const CDeterministicMNList& tip_mn_list, const ChainstateManager& chainman,
+                        const governance::CollateralSource* collateral, std::string& strError,
+                        bool& fMissingConfirmations, bool fCheckCollateral) const EXCLUSIVE_LOCKS_REQUIRED(::cs_main);
 
     /// Check the collateral transaction for the budget proposal/finalized budget
-    bool IsCollateralValid(const ChainstateManager& chainman, std::string& strError, bool& fMissingConfirmations) const
-        EXCLUSIVE_LOCKS_REQUIRED(::cs_main);
+    bool IsCollateralValid(const governance::CollateralSource* collateral, const ChainstateManager& chainman,
+                           std::string& strError, bool& fMissingConfirmations) const EXCLUSIVE_LOCKS_REQUIRED(::cs_main);
 
     void UpdateLocalValidity(const CDeterministicMNList& tip_mn_list, const ChainstateManager& chainman)
         EXCLUSIVE_LOCKS_REQUIRED(::cs_main);
diff --git a/src/governance/signing.cpp b/src/governance/signing.cpp
index da2b5752085e..a69fdbc491e6 100644
--- a/src/governance/signing.cpp
+++ b/src/governance/signing.cpp
@@ -162,7 +162,8 @@ std::optional<const CGovernanceObject> GovernanceSigner::CreateGovernanceTrigger
     gov_sb.SetMasternodeOutpoint(m_mn_activeman.GetOutPoint());
     gov_sb.SetSignature(m_mn_activeman.SignBasic(gov_sb.GetSignatureHash()));
 
-    if (std::string strError; !gov_sb.IsValidLocally(m_dmnman.GetListAtChainTip(), m_chainman, strError, true)) {
+    if (std::string strError;
+        !gov_sb.IsValidLocally(m_dmnman.GetListAtChainTip(), m_chainman, m_govman.GetCollateralSource(), strError, true)) {
         LogPrint(BCLog::GOBJECT, "%s -- Created trigger is invalid:%s\n", __func__, strError);
         return std::nullopt;
     }
diff --git a/src/init.cpp b/src/init.cpp
index 008ae13fdb33..0cce8815ae67 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -34,6 +34,7 @@
 #include <index/addressindex.h>
 #include <index/blockfilterindex.h>
 #include <index/coinstatsindex.h>
+#include <index/govcollateralindex.h>
 #include <index/spentindex.h>
 #include <index/timestampindex.h>
 #include <index/txindex.h>
@@ -298,6 +299,9 @@ void Interrupt(NodeContext& node)
     if (g_txindex) {
         g_txindex->Interrupt();
     }
+    if (node.gov_collateral_index) {
+        node.gov_collateral_index->Interrupt();
+    }
     if (node.address_index) {
         node.address_index->Interrupt();
     }
@@ -424,6 +428,10 @@ void PrepareShutdown(NodeContext& node)
         g_txindex->Stop();
         g_txindex.reset();
     }
+    if (node.gov_collateral_index) {
+        node.gov_collateral_index->Stop();
+        node.gov_collateral_index.reset();
+    }
     if (node.address_index) {
         node.address_index->Stop();
         node.address_index.reset();
@@ -629,7 +637,7 @@ void SetupServerArgs(ArgsManager& argsman)
         llmq::MAX_BLSCHECK_THREADS, llmq::DEFAULT_BLSCHECK_THREADS), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
     argsman.AddArg("-persistmempool", strprintf("Whether to save the mempool on shutdown and load on restart (default: %u)", DEFAULT_PERSIST_MEMPOOL), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
     argsman.AddArg("-pid=<file>", strprintf("Specify pid file. Relative paths will be prefixed by a net-specific datadir location. (default: %s)", BITCOIN_PID_FILENAME), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
-    argsman.AddArg("-prune=<n>", strprintf("Reduce storage requirements by enabling pruning (deleting) of old blocks. This allows the pruneblockchain RPC to be called to delete specific blocks, and enables automatic pruning of old blocks if a target size in MiB is provided. This mode is incompatible with -txindex, -addressindex, -spentindex and -disablegovernance=false. "
+    argsman.AddArg("-prune=<n>", strprintf("Reduce storage requirements by enabling pruning (deleting) of old blocks. This allows the pruneblockchain RPC to be called to delete specific blocks, and enables automatic pruning of old blocks if a target size in MiB is provided. This mode is incompatible with -txindex, -addressindex and -spentindex. "
             "Warning: Reverting this setting requires re-downloading the entire blockchain. "
             "(default: 0 = disable pruning blocks, 1 = allow manual pruning via RPC, >%u = automatically prune block files to stay under the specified target size in MiB)", MIN_DISK_SPACE_FOR_BLOCK_FILES / 1024 / 1024), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
     argsman.AddArg("-settings=<file>", strprintf("Specify path to dynamic settings data file. Can be disabled with -nosettings. File is written at runtime and not meant to be edited by users (use %s instead for custom settings). Relative paths will be prefixed by datadir location. (default: %s)", BITCOIN_CONF_FILENAME, BITCOIN_SETTINGS_FILENAME), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
@@ -1086,9 +1094,6 @@ void InitParameterInteraction(ArgsManager& args)
 
     int64_t nPruneArg = args.GetIntArg("-prune", 0);
     if (nPruneArg > 0) {
-        if (args.SoftSetBoolArg("-disablegovernance", true)) {
-            LogPrintf("%s: parameter interaction: -prune=%d -> setting -disablegovernance=true\n", __func__, nPruneArg);
-        }
         if (args.SoftSetBoolArg("-txindex", false)) {
             LogPrintf("%s: parameter interaction: -prune=%d -> setting -txindex=false\n", __func__, nPruneArg);
         }
@@ -1258,9 +1263,6 @@ bool AppInitParameterInteraction(const ArgsManager& args)
         if (args.GetBoolArg("-reindex-chainstate", false)) {
             return InitError(_("Prune mode is incompatible with -reindex-chainstate. Use full -reindex instead."));
         }
-        if (!args.GetBoolArg("-disablegovernance", !DEFAULT_GOVERNANCE_ENABLE)) {
-            return InitError(_("Prune mode is incompatible with -disablegovernance=false."));
-        }
     }
 
     if (args.IsArgSet("-devnet")) {
@@ -1430,18 +1432,8 @@ bool AppInitParameterInteraction(const ArgsManager& args)
         }
     }
 
-    // Governance needs the transaction index to look up proposal collateral transactions
-    if (!args.GetBoolArg("-disablegovernance", !DEFAULT_GOVERNANCE_ENABLE) &&
-        !args.GetBoolArg("-txindex", DEFAULT_TXINDEX) && chainparams.NetworkIDString() != CBaseChainParams::REGTEST) {
-        return InitError(_("Transaction index can't be disabled with governance validation enabled. Either start with "
-                           "-disablegovernance command line switch or enable transaction index."));
-    }
-
     if (args.GetBoolArg("-disablegovernance", !DEFAULT_GOVERNANCE_ENABLE)) {
-        InitWarning(_("You are starting with governance validation disabled.") +
-            (fPruneMode ?
-                Untranslated(" ") + _("This is expected because you are running a pruned node.") :
-                Untranslated("")));
+        InitWarning(_("You are starting with governance validation disabled."));
     }
 
     // Also report errors from parsing before daemonization
@@ -1728,7 +1720,7 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
     assert(!node.netfulfilledman);
     node.netfulfilledman = std::make_unique<CNetFulfilledRequestManager>();
 
-    const bool is_governance_enabled{!args.GetBoolArg("-disablegovernance", !DEFAULT_GOVERNANCE_ENABLE)};
+    bool is_governance_enabled{!args.GetBoolArg("-disablegovernance", !DEFAULT_GOVERNANCE_ENABLE)};
 
     assert(!node.sporkman);
     node.sporkman = std::make_unique<CSporkManager>();
@@ -2159,8 +2151,23 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
     node.clhandler = std::make_unique<chainlock::ChainlockHandler>(*node.chainlocks, chainman, *node.mempool, *node.mn_sync);
     RegisterValidationInterface(node.clhandler.get());
 
+    auto gov_collateral_index{
+        std::make_unique<GovCollateralIndex>(interfaces::MakeChain(node), /*n_cache_size=*/0, false, fReindex)};
+    // The index can't catch up once the node has pruned blocks it hasn't read, e.g. after upgrading a pruned
+    // node, because a new index has to start from the genesis block. Starting it would fail with an init
+    // error, so leave governance off instead.
+    if (WITH_LOCK(::cs_main, return gov_collateral_index->CanSync(chainman.ActiveChainstate()))) {
+        node.gov_collateral_index = std::move(gov_collateral_index);
+    } else if (is_governance_enabled) {
+        is_governance_enabled = false;
+        InitWarning(_("Governance is disabled because this node has already pruned the old blocks it needs to build "
+                      "the governance collateral index. Restart once with -reindex to enable governance; the "
+                      "blockchain will be downloaded again but the node stays pruned."));
+    }
+
     assert(!node.govman);
-    node.govman = std::make_unique<CGovernanceManager>(*node.mn_metaman, *node.chainman, *node.sbman, *node.dmnman, *node.mn_sync);
+    node.govman = std::make_unique<CGovernanceManager>(*node.mn_metaman, *node.chainman, *node.sbman, *node.dmnman,
+                                                       *node.mn_sync, node.gov_collateral_index.get());
 
     // ********************************************************* Step 7c: Setup masternode mode or watch-only mode
     assert(!node.active_ctx);
@@ -2303,6 +2310,10 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
         }
     }
 
+    if (node.gov_collateral_index && !node.gov_collateral_index->Start()) {
+        return false;
+    }
+
     if (args.GetBoolArg("-addressindex", DEFAULT_ADDRESSINDEX)) {
         node.address_index = std::make_unique<AddressIndex>(interfaces::MakeChain(node), cache_sizes.address_index, false, fReindex);
         if (!node.address_index->Start()) {
diff --git a/src/net_processing.cpp b/src/net_processing.cpp
index 2a956dd97c39..017616c5a5a9 100644
--- a/src/net_processing.cpp
+++ b/src/net_processing.cpp
@@ -440,6 +440,9 @@ struct Peer {
     /** Whether we've sent this peer a getheaders in response to an inv prior to initial-headers-sync completing */
     bool m_inv_triggered_getheaders_before_sync GUARDED_BY(NetEventsInterface::g_msgproc_mutex){false};
 
+    /** Announcements from this peer that a handler can't process yet (see NetHandler::DeferAnnouncement) */
+    std::deque<CInv> m_deferred_announcements GUARDED_BY(NetEventsInterface::g_msgproc_mutex);
+
     /** Protects m_getdata_requests **/
     Mutex m_getdata_requests_mutex;
     /** Work queue of items requested by this peer **/
@@ -691,8 +694,9 @@ class PeerManagerImpl final : public PeerManager
     void RelayInvFiltered(const CInv& inv, const uint256& relatedTxHash) EXCLUSIVE_LOCKS_REQUIRED(!m_peer_mutex);
 
     /** Register with m_object_request that an inv has been received from a peer, computing the
-     *  request delay from the peer's preferredness and in-flight load. */
-    void AddObjectAnnouncement(const CNode& node, const CInv& inv, std::chrono::microseconds current_time)
+     *  request delay from the peer's preferredness and in-flight load. Returns false if the peer has too
+     *  many announcements pending to register another one. */
+    bool AddObjectAnnouncement(const CNode& node, const CInv& inv, std::chrono::microseconds current_time)
         EXCLUSIVE_LOCKS_REQUIRED(!m_object_request_mutex, ::cs_main);
 
     /** Delete all announcements of a transaction across all peers, under the inv types it may
@@ -1006,6 +1010,7 @@ class PeerManagerImpl final : public PeerManager
 
     bool AlreadyHave(const CInv& inv)
         EXCLUSIVE_LOCKS_REQUIRED(cs_main, !m_recent_confirmed_transactions_mutex);
+    bool DeferAnnouncement(const CInv& inv) const;
 
     /**
      * Filter for transactions that were recently rejected by the mempool.
@@ -1657,17 +1662,17 @@ bool IsGetDataOnlyObject(int invType)
     }
 }
 
-void PeerManagerImpl::AddObjectAnnouncement(const CNode& node, const CInv& inv, std::chrono::microseconds current_time)
+bool PeerManagerImpl::AddObjectAnnouncement(const CNode& node, const CInv& inv, std::chrono::microseconds current_time)
 {
     AssertLockHeld(cs_main);
 
     const CNodeState* state = State(node.GetId());
-    if (state == nullptr) return;
+    if (state == nullptr) return true;
 
     LOCK(m_object_request_mutex);
     if (m_object_request.Count(node.GetId()) >= MAX_PEER_OBJECT_ANNOUNCEMENTS) {
         // Too many queued announcements from this peer
-        return;
+        return false;
     }
 
     // Decide the TxRequestTracker parameters for this announcement:
@@ -1686,6 +1691,7 @@ void PeerManagerImpl::AddObjectAnnouncement(const CNode& node, const CInv& inv,
     if (overloaded) delay += OVERLOADED_PEER_OBJECT_DELAY;
 
     m_object_request.ReceivedInv(node.GetId(), inv, preferred, current_time + delay);
+    return true;
 }
 
 void PeerManagerImpl::ForgetTx(const uint256& txid)
@@ -2482,6 +2488,12 @@ bool PeerManagerImpl::AlreadyHave(const CInv& inv)
     return true;
 }
 
+bool PeerManagerImpl::DeferAnnouncement(const CInv& inv) const
+{
+    return std::any_of(m_handlers.begin(), m_handlers.end(),
+                       [&](const auto& handler) { return handler->DeferAnnouncement(inv); });
+}
+
 bool PeerManagerImpl::AlreadyHaveBlock(const uint256& block_hash)
 {
     return m_chainman.m_blockman.LookupBlockIndex(block_hash) != nullptr;
@@ -4590,8 +4602,9 @@ void PeerManagerImpl::ProcessMessage(
                     return;
                 }
 
-                const bool fAlreadyHave = AlreadyHave(inv);
-                LogPrint(BCLog::NET, "got inv: %s  %s peer=%d\n", inv.ToString(), fAlreadyHave ? "have" : "new", pfrom.GetId());
+                const bool deferred = DeferAnnouncement(inv);
+                const bool fAlreadyHave = !deferred && AlreadyHave(inv);
+                LogPrint(BCLog::NET, "got inv: %s  %s peer=%d\n", inv.ToString(), deferred ? "deferred" : fAlreadyHave ? "have" : "new", pfrom.GetId());
                 ::g_stats_client->inc(strprintf("message.received.inv_%s", inv.GetCommand()), 1.0f);
 
                 static std::set<int> allowWhileInIBDObjs = {
@@ -4599,7 +4612,16 @@ void PeerManagerImpl::ProcessMessage(
                 };
 
                 AddKnownInv(*peer, inv.hash);
-                if (!fAlreadyHave) {
+                if (deferred) {
+                    if (peer->m_deferred_announcements.size() >= MAX_PEER_OBJECT_ANNOUNCEMENTS) {
+                        // The peer won't announce this one again on this connection. A new connection gets it from
+                        // the handler's sync, which can't have asked this one yet while it holds announcements.
+                        LogPrint(BCLog::NET, "peer=%d announced more objects than can be held, disconnecting\n", pfrom.GetId());
+                        pfrom.fDisconnect = true;
+                        return;
+                    }
+                    peer->m_deferred_announcements.push_back(inv);
+                } else if (!fAlreadyHave) {
                     if (reject_tx_invs && inv.type == MSG_ISDLOCK) {
                         if (pfrom.GetCommonVersion() <= ADDRV2_PROTO_VERSION) {
                             // It's ok to receive these invs, we just ignore them
@@ -6914,6 +6936,21 @@ bool PeerManagerImpl::SendMessages(CNode* pto)
         }
     } // release cs_main
 
+    // Handlers defer by state, so the oldest held announcement tells whether any can be requested now
+    if (!peer->m_deferred_announcements.empty() && !DeferAnnouncement(peer->m_deferred_announcements.front())) {
+        // In the order they were announced, as many as the peer's pending announcements leave room for. The rest
+        // wait until its earlier announcements have been requested. The handler's state can change meanwhile, e.g.
+        // on an mnsync reset, and AlreadyHave() would then claim the rest without requesting them.
+        LOCK(cs_main);
+        auto& held{peer->m_deferred_announcements};
+        auto released{held.begin()};
+        while (released != held.end() && !DeferAnnouncement(*released) &&
+               (AlreadyHave(*released) || AddObjectAnnouncement(*pto, *released, current_time))) {
+            ++released;
+        }
+        held.erase(held.begin(), released);
+    }
+
     //
     // Message: getdata (non-blocks)
     //
diff --git a/src/net_processing.h b/src/net_processing.h
index fb3543c1ec91..ada7c7ad153f 100644
--- a/src/net_processing.h
+++ b/src/net_processing.h
@@ -142,6 +142,12 @@ class NetHandler
     // It returns true, if NetHandler has a responsibility about having this type of inventory and has corresponding data.
     virtual bool AlreadyHave(const CInv& inv) { return false; }
 
+    // Whether announcements of this inv should be held until the handler can process the object. Held
+    // announcements are requested from their announcers once this returns false; dropping them instead would
+    // lose the object on that connection, because the peer doesn't announce an inv twice. The answer must
+    // depend only on the handler's state, so that it's the same for every inv the handler defers.
+    virtual bool DeferAnnouncement(const CInv& inv) { return false; }
+
     // It should return true, if there's data has been pushed
     virtual bool ProcessGetData(CNode& pfrom, const CInv& inv, const CNetMsgMaker& msgMaker) { return false; }
 protected:
diff --git a/src/node/context.cpp b/src/node/context.cpp
index 244e2ed94c22..695092a2bfc6 100644
--- a/src/node/context.cpp
+++ b/src/node/context.cpp
@@ -17,6 +17,7 @@
 #include <txmempool.h>
 #include <validation.h>
 #include <index/addressindex.h>
+#include <index/govcollateralindex.h>
 #include <index/spentindex.h>
 #include <index/timestampindex.h>
 
diff --git a/src/node/context.h b/src/node/context.h
index ddda10a4f60e..ad8629f73d35 100644
--- a/src/node/context.h
+++ b/src/node/context.h
@@ -34,6 +34,7 @@ class CScheduler;
 class CSpecialTxProcessor;
 class CSporkManager;
 class CTxMemPool;
+class GovCollateralIndex;
 class NetGroupManager;
 class PeerManager;
 class SpentIndex;
@@ -122,6 +123,7 @@ struct NodeContext {
     std::unique_ptr<llmq::ObserverContext> observer_ctx;
     //! Dash indexes
     std::unique_ptr<AddressIndex> address_index;
+    std::unique_ptr<GovCollateralIndex> gov_collateral_index;
     std::unique_ptr<SpentIndex> spent_index;
     std::unique_ptr<TimestampIndex> timestamp_index;
 
diff --git a/src/node/interfaces.cpp b/src/node/interfaces.cpp
index d0de956bde8c..7781e4e27e72 100644
--- a/src/node/interfaces.cpp
+++ b/src/node/interfaces.cpp
@@ -22,6 +22,7 @@
 #include <governance/superblock.h>
 #include <governance/vote.h>
 #include <index/blockfilterindex.h>
+#include <index/govcollateralindex.h>
 #include <init.h>
 #include <instantsend/instantsend.h>
 #include <interfaces/chain.h>
@@ -508,7 +509,8 @@ class GOVImpl : public GOV
         {
             LOCK(::cs_main);
             std::string strError;
-            if (!govobj.IsValidLocally(Assert(context().dmnman)->GetListAtChainTip(), chainman, strError, false)) {
+            if (!govobj.IsValidLocally(Assert(context().dmnman)->GetListAtChainTip(), chainman, /*collateral=*/nullptr,
+                                       strError, false)) {
                 error = "Governance object is not valid - " + govobj.GetHash().ToString() + " - " + strError;
                 return std::nullopt;
             }
@@ -533,7 +535,9 @@ class GOVImpl : public GOV
         {
             LOCK2(cs_main, mempool.cs);
             std::string strError;
-            if (!govobj.IsValidLocally(mnList, *Assert(context().chainman), strError, fMissingConfirmations, true) && !fMissingConfirmations) {
+            if (!govobj.IsValidLocally(mnList, *Assert(context().chainman), context().gov_collateral_index.get(),
+                                       strError, fMissingConfirmations, true) &&
+                !fMissingConfirmations) {
                 error = "Governance object is not valid - " + govobj.GetHash().ToString() + " - " + strError;
                 return false;
             }
diff --git a/src/node/sync_manager.cpp b/src/node/sync_manager.cpp
index 5d170e79a2d9..c8159d2d6b55 100644
--- a/src/node/sync_manager.cpp
+++ b/src/node/sync_manager.cpp
@@ -241,6 +241,11 @@ void SyncManager::ProcessTick()
                     m_node_sync.SwitchToNextAsset();
                     return;
                 }
+                if (m_gov_manager.IsCollateralSourceBehind()) {
+                    // Every proposal would fail its collateral check, so wait for the index without timing out
+                    m_node_sync.BumpAssetLastTime("SyncManager::ProcessTick");
+                    return;
+                }
                 LogPrint(BCLog::GOBJECT, "Sync Tick -- nTick %d asset_id %d last_bump %lld GetTime() %lld diff %lld\n",
                          nTick, asset_id, m_node_sync.GetLastBump(), GetTime(), GetTime() - m_node_sync.GetLastBump());
 
diff --git a/src/qt/optionsmodel.cpp b/src/qt/optionsmodel.cpp
index 8ada0fb71e46..fa9f1ebe8bc7 100644
--- a/src/qt/optionsmodel.cpp
+++ b/src/qt/optionsmodel.cpp
@@ -536,9 +536,8 @@ void OptionsModel::SetPruneTargetGB(int prune_target_gb)
     // shown, before the node starts.
     node().forceSetting("prune", new_value);
 
-    // When pruning is enabled, force disable governance and txindex
+    // Pruning is incompatible with txindex. Governance keeps working through the governance collateral index.
     if (prune_target_gb > 0) {
-        node().forceSetting("disablegovernance", "1");
         node().forceSetting("txindex", "0");
     }
 
diff --git a/src/rpc/governance.cpp b/src/rpc/governance.cpp
index e6c547175b84..12253689a490 100644
--- a/src/rpc/governance.cpp
+++ b/src/rpc/governance.cpp
@@ -14,7 +14,7 @@
 
 #include <chainparams.h>
 #include <core_io.h>
-#include <index/txindex.h>
+#include <index/govcollateralindex.h>
 #include <node/context.h>
 #include <rpc/server.h>
 #include <rpc/server_util.h>
@@ -58,6 +58,13 @@ static vote_outcome_enum_t ParseVoteOutcome(const UniValue& param)
     return outcome;
 }
 
+static void BlockUntilCollateralIndexSynced(const NodeContext& node)
+{
+    if (node.gov_collateral_index) {
+        node.gov_collateral_index->BlockUntilSyncedToCurrentChain();
+    }
+}
+
 static RPCHelpMan gobject_count()
 {
     const auto json_help{CGovernanceManager::GetJsonHelp(/*key=*/"", /*optional=*/false)};
@@ -224,19 +231,18 @@ static RPCHelpMan gobject_prepare()
         throw JSONRPCError(RPC_INVALID_PARAMETER, "Trigger objects need not be prepared (however only masternodes can create them)");
     }
 
-    if (g_txindex) {
-        g_txindex->BlockUntilSyncedToCurrentChain();
-    }
-
-    LOCK(wallet->cs_wallet);
-
     const NodeContext& node = EnsureAnyNodeContext(request.context);
     const ChainstateManager& chainman = EnsureChainman(node);
 
+    BlockUntilCollateralIndexSynced(node);
+
+    LOCK(wallet->cs_wallet);
+
     {
         LOCK(cs_main);
         std::string strError;
-        if (!govobj.IsValidLocally(CHECK_NONFATAL(node.dmnman)->GetListAtChainTip(), chainman, strError, false))
+        if (!govobj.IsValidLocally(CHECK_NONFATAL(node.dmnman)->GetListAtChainTip(), chainman, /*collateral=*/nullptr,
+                                   strError, false))
             throw JSONRPCError(RPC_INTERNAL_ERROR, "Governance object is not valid - " + govobj.GetHash().ToString() + " - " + strError);
     }
 
@@ -408,14 +414,14 @@ static RPCHelpMan gobject_submit()
     const CTxMemPool& mempool = EnsureMemPool(node);
     bool fMissingConfirmations;
     {
-        if (g_txindex) {
-            g_txindex->BlockUntilSyncedToCurrentChain();
-        }
+        BlockUntilCollateralIndexSynced(node);
 
         LOCK2(cs_main, mempool.cs);
 
         std::string strError;
-        if (!govobj.IsValidLocally(node.dmnman->GetListAtChainTip(), chainman, strError, fMissingConfirmations, true) && !fMissingConfirmations) {
+        if (!govobj.IsValidLocally(node.dmnman->GetListAtChainTip(), chainman, node.gov_collateral_index.get(), strError,
+                                   fMissingConfirmations, true) &&
+            !fMissingConfirmations) {
             LogPrintf("gobject(submit) -- Object submission rejected because object is not valid - hash = %s, strError = %s\n", strHash, strError);
             throw JSONRPCError(RPC_INTERNAL_ERROR, "Governance object is not valid - " + strHash + " - " + strError);
         }
@@ -621,10 +627,6 @@ static RPCHelpMan gobject_vote_alias()
 static UniValue ListObjects(CGovernanceManager& govman, const CDeterministicMNList& tip_mn_list, const ChainstateManager& chainman,
                             const std::string& strCachedSignal, const std::string& strType, int nStartTime)
 {
-    if (g_txindex) {
-        g_txindex->BlockUntilSyncedToCurrentChain();
-    }
-
     std::vector<CGovernanceObject> objs;
     govman.GetAllNewerThan(objs, nStartTime);
     govman.UpdateLastDiffTime(GetTime());
@@ -702,6 +704,8 @@ static RPCHelpMan gobject_list_helper(const bool make_a_diff)
     const NodeContext& node = EnsureAnyNodeContext(request.context);
     const ChainstateManager& chainman = EnsureChainman(node);
 
+    BlockUntilCollateralIndexSynced(node);
+
     const int64_t last_time = make_a_diff ? node.govman->GetLastDiffTime() : 0;
     return ListObjects(*CHECK_NONFATAL(node.govman), CHECK_NONFATAL(node.dmnman)->GetListAtChainTip(), chainman,
                        strCachedSignal, strType, last_time);
@@ -741,13 +745,11 @@ static RPCHelpMan gobject_get()
         RPCExamples{""},
         [&](const RPCHelpMan& self, const JSONRPCRequest& request) -> UniValue
 {
-    if (g_txindex) {
-        g_txindex->BlockUntilSyncedToCurrentChain();
-    }
-
     const NodeContext& node = EnsureAnyNodeContext(request.context);
     const ChainstateManager& chainman = EnsureChainman(node);
 
+    BlockUntilCollateralIndexSynced(node);
+
     uint256 hash(ParseHashV(request.params[0], "GovObj hash"));
     auto pGovObj = CHECK_NONFATAL(node.govman)->FindConstGovernanceObject(hash);
     if (pGovObj == nullptr) {
diff --git a/src/rpc/node.cpp b/src/rpc/node.cpp
index 3335429e7af6..3d5c71c346da 100644
--- a/src/rpc/node.cpp
+++ b/src/rpc/node.cpp
@@ -15,6 +15,7 @@
 #include <index/addressindex.h>
 #include <index/blockfilterindex.h>
 #include <index/coinstatsindex.h>
+#include <index/govcollateralindex.h>
 #include <index/spentindex.h>
 #include <index/timestampindex.h>
 #include <index/txindex.h>
@@ -1216,6 +1217,10 @@ static RPCHelpMan getindexinfo()
         result.pushKVs(SummaryToJSON(g_coin_stats_index->GetSummary(), index_name));
     }
 
+    if (node.gov_collateral_index) {
+        result.pushKVs(SummaryToJSON(node.gov_collateral_index->GetSummary(), index_name));
+    }
+
     ForEachBlockFilterIndex([&result, &index_name](const BlockFilterIndex& index) {
         result.pushKVs(SummaryToJSON(index.GetSummary(), index_name));
     });
diff --git a/src/test/governance_collateral_tests.cpp b/src/test/governance_collateral_tests.cpp
index 880e7e873044..74aa3c4a8382 100644
--- a/src/test/governance_collateral_tests.cpp
+++ b/src/test/governance_collateral_tests.cpp
@@ -4,9 +4,11 @@
 
 #include <consensus/validation.h>
 #include <governance/collateral.h>
+#include <governance/object.h>
 #include <index/govcollateralindex.h>
 #include <interfaces/chain.h>
 #include <key.h>
+#include <key_io.h>
 #include <primitives/transaction.h>
 #include <script/standard.h>
 #include <util/strencodings.h>
@@ -29,9 +31,14 @@ CScript BurnScript(const uint256& hash) { return CScript() << OP_RETURN << ToByt
 struct CollateralSetup : public TestChain100Setup {
     std::unique_ptr<GovCollateralIndex> index;
     SimpleUTXOMap utxos;
+    std::string payment_address;
 
     CollateralSetup()
     {
+        CKey payment_key;
+        payment_key.MakeNewKey(true);
+        payment_address = EncodeDestination(PKHash(payment_key.GetPubKey()));
+
         // Matures a few coinbases so the burns below can be funded
         for (int i = 0; i < 5; ++i) {
             MineBlock({});
@@ -52,6 +59,15 @@ struct CollateralSetup : public TestChain100Setup {
         return CreateAndProcessBlock(txns, GetScriptForRawPubKey(coinbaseKey.GetPubKey()));
     }
 
+    //! Mines `tx` and enough blocks on top of it for its collateral to be fully confirmed
+    void MineConfirmed(const CMutableTransaction& tx)
+    {
+        MineBlock({tx});
+        for (int i = 1; i < GOVERNANCE_FEE_CONFIRMATIONS; ++i) {
+            MineBlock({});
+        }
+    }
+
     CMutableTransaction MakeBurn(const uint256& hash, CAmount amount, const std::vector<CTxOut>& extra_outputs = {})
     {
         CMutableTransaction tx;
@@ -61,14 +77,35 @@ struct CollateralSetup : public TestChain100Setup {
         return tx;
     }
 
-    void StartIndex()
+    void CreateIndex()
     {
         // A block notification still queued from MineBlock would reach the index after it synced past that block
         SyncWithValidationInterfaceQueue();
         index = std::make_unique<GovCollateralIndex>(interfaces::MakeChain(m_node), /*n_cache_size=*/0, /*f_memory=*/true);
+    }
+
+    void StartIndex()
+    {
+        CreateIndex();
         BOOST_REQUIRE(index->Start());
         IndexWaitSynced(*index);
     }
+
+    //! The object hash leaves out the collateral hash, so every call returns the same proposal
+    CGovernanceObject MakeProposal(const uint256& collateral_hash) const
+    {
+        const std::string data{
+            R"({"type":1,"name":"proposal","start_epoch":1700000000,"end_epoch":1700100000,"payment_amount":1.0,"payment_address":")" +
+            payment_address + R"(","url":"https://dash.org"})"};
+        return CGovernanceObject{uint256{}, /*revision=*/1, /*nTime=*/1700000000, collateral_hash, HexStr(data)};
+    }
+
+    bool IsCollateralValid(const CGovernanceObject& govobj, std::string& error) const
+    {
+        bool missing_confirmations;
+        return WITH_LOCK(::cs_main,
+                         return govobj.IsCollateralValid(index.get(), *m_node.chainman, error, missing_confirmations));
+    }
 };
 } // namespace
 
@@ -142,4 +179,29 @@ BOOST_FIXTURE_TEST_CASE(index_records_transactions_burning_the_proposal_fee, Col
     BOOST_CHECK(index->FindCollateral(fee_burn.GetHash()));
 }
 
+BOOST_FIXTURE_TEST_CASE(proposal_collateral_is_checked_against_the_index, CollateralSetup)
+{
+    const auto burn{MakeBurn(MakeProposal(uint256{}).GetHash(), GOVERNANCE_PROPOSAL_FEE_TX)};
+    const CGovernanceObject proposal{MakeProposal(burn.GetHash())};
+    MineConfirmed(burn);
+
+    // A collateral burning to a different object hash
+    const auto other_burn{MakeBurn(uint256S("aa"), GOVERNANCE_PROPOSAL_FEE_TX)};
+    const CGovernanceObject wrong_burn{MakeProposal(other_burn.GetHash())};
+    MineConfirmed(other_burn);
+
+    std::string error;
+    BOOST_CHECK(!IsCollateralValid(proposal, error));
+    BOOST_CHECK_EQUAL(error, "Can't look up collateral, the governance collateral index isn't running");
+
+    CreateIndex();
+    BOOST_CHECK(!IsCollateralValid(proposal, error));
+    BOOST_CHECK_EQUAL(error, "Can't look up collateral until the governance collateral index has synced");
+
+    StartIndex();
+    BOOST_CHECK_MESSAGE(IsCollateralValid(proposal, error), error);
+    BOOST_CHECK(!IsCollateralValid(wrong_burn, error));
+    BOOST_CHECK(error.find("Couldn't find opReturn") == 0);
+}
+
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/governance_inv_tests.cpp b/src/test/governance_inv_tests.cpp
index a9fe709acacc..aeea233f7ad7 100644
--- a/src/test/governance_inv_tests.cpp
+++ b/src/test/governance_inv_tests.cpp
@@ -2,7 +2,9 @@
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
+#include <arith_uint256.h>
 #include <common/bloom.h>
+#include <governance/collateral.h>
 #include <governance/governance.h>
 #include <governance/net_governance.h>
 #include <governance/object.h>
@@ -33,7 +35,17 @@
 using namespace std::chrono_literals;
 
 namespace {
+//! Knows no collateral, like a synced index on a chain without fee burns
+struct EmptyCollateralSource final : public governance::CollateralSource {
+    std::atomic<bool> synced{true};
+
+    bool IsCollateralSynced() const override { return synced; }
+    std::optional<governance::CollateralInfo> FindCollateral(const uint256&) const override { return std::nullopt; }
+};
+
 struct GovernanceInvSetup : public TestingSetup {
+    EmptyCollateralSource m_collateral;
+
     GovernanceInvSetup() : TestingSetup{CBaseChainParams::MAIN}
     {
         // ConfirmInventoryRequest and the NetGovernance object/vote handlers
@@ -46,7 +58,8 @@ struct GovernanceInvSetup : public TestingSetup {
         // Note: mn_metaman is left unloaded. Reaching CGovernanceObject::ProcessVote asserts
         // metaman.IsValid(), so a test that delivers a vote whose parent object exists must
         // load it first (see invalid_vote_is_scored_alike_with_and_without_a_parent_object).
-        m_node.govman = std::make_unique<CGovernanceManager>(*m_node.mn_metaman, *m_node.chainman, *m_node.sbman, *m_node.dmnman, *m_node.mn_sync);
+        m_node.govman = std::make_unique<CGovernanceManager>(*m_node.mn_metaman, *m_node.chainman, *m_node.sbman,
+                                                             *m_node.dmnman, *m_node.mn_sync, &m_collateral);
         // Match runtime preconditions: NetGovernance::AlreadyHave claims we
         // already have the inv when governance isn't loaded (e.g.
         // -disablegovernance), so ConfirmInventoryRequest would never run.
@@ -93,12 +106,12 @@ size_t CountQueuedMessages(const CNode& peer, const std::string& msg_type)
     return count;
 }
 
-size_t CountQueuedInventory(const CNode& peer, const CInv& expected_inv)
+size_t CountQueuedInventory(const CNode& peer, const CInv& expected_inv, const std::string& msg_type = NetMsgType::INV)
 {
     LOCK(peer.cs_vSend);
     size_t count{0};
     for (const auto& msg : peer.vSendMsg) {
-        if (msg.m_type != NetMsgType::INV) {
+        if (msg.m_type != msg_type) {
             continue;
         }
         CDataStream stream{msg.data, SER_NETWORK, PROTOCOL_VERSION};
@@ -132,15 +145,21 @@ std::unique_ptr<CNode> MakeGovernanceInvPeer(NodeId id)
     return peer;
 }
 
-void ProcessInv(PeerManager& peerman, CNode& peer, const CInv& inv)
+void ProcessInvs(PeerManager& peerman, CNode& peer, const std::vector<CInv>& invs)
     EXCLUSIVE_LOCKS_REQUIRED(NetEventsInterface::g_msgproc_mutex)
 {
     CDataStream inv_stream{SER_NETWORK, PROTOCOL_VERSION};
-    inv_stream << std::vector<CInv>{inv};
+    inv_stream << invs;
     std::atomic<bool> interrupt_dummy{false};
     peerman.ProcessMessage(peer, NetMsgType::INV, inv_stream, GetTime<std::chrono::microseconds>(), interrupt_dummy);
 }
 
+void ProcessInv(PeerManager& peerman, CNode& peer, const CInv& inv)
+    EXCLUSIVE_LOCKS_REQUIRED(NetEventsInterface::g_msgproc_mutex)
+{
+    ProcessInvs(peerman, peer, {inv});
+}
+
 CGovernanceObject MakeGovernanceObject(int64_t creation_time, const uint256& collateral_hash)
 {
     const std::string data{
@@ -367,6 +386,94 @@ BOOST_AUTO_TEST_CASE(governance_objects_require_peer_announcement_or_request)
     chainstate.ResetIbd();
 }
 
+BOOST_AUTO_TEST_CASE(governance_objects_wait_for_the_collateral_index)
+{
+    LOCK(NetEventsInterface::g_msgproc_mutex);
+
+    TestChainState& chainstate =
+        *static_cast<TestChainState*>(&m_node.chainman->ActiveChainstate());
+    chainstate.JumpOutOfIbd();
+
+    NetGovernance net_gov(m_node.peerman.get(), *m_node.govman, *m_node.mn_sync,
+                          *m_node.netfulfilledman, *m_node.connman);
+    auto peer{MakeGovernanceInvPeer(/*id=*/31)};
+    m_node.peerman->InitializeNode(*peer, NODE_NETWORK);
+    auto flooding_peer{MakeGovernanceInvPeer(/*id=*/32)};
+    m_node.peerman->InitializeNode(*flooding_peer, NODE_NETWORK);
+
+    // Its collateral doesn't exist, so the object is invalid once collateral can be looked up
+    const CGovernanceObject govobj{MakeGovernanceObject(GetTime<std::chrono::seconds>().count(), uint256S("31"))};
+    const CInv object_inv{MSG_GOVERNANCE_OBJECT, govobj.GetHash()};
+
+    // An index that hasn't synced yet would report every collateral as missing
+    m_collateral.synced = false;
+    BOOST_REQUIRE(m_node.govman->IsCollateralSourceBehind());
+
+    // The announcement is held instead of requested
+    ProcessInv(*m_node.peerman, *peer, object_inv);
+    m_node.peerman->SendMessages(peer.get());
+    BOOST_CHECK_EQUAL(CountQueuedInventory(*peer, object_inv, NetMsgType::GETDATA), 0U);
+    BOOST_CHECK(!WITH_LOCK(::cs_main, return m_node.peerman->PeerConsumeObjectRequest(peer->GetId(), object_inv)));
+    ProcessGovernanceObject(net_gov, *peer, govobj);
+    BOOST_CHECK(!m_node.govman->HaveObjectForHash(govobj.GetHash()));
+    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 0);
+
+    // The peer's transaction announcements take up all the announcements it may have pending
+    // (MAX_PEER_OBJECT_ANNOUNCEMENTS)
+    std::vector<CInv> tx_invs;
+    for (uint64_t i = 0; i < 2 * MAX_INV_SZ; ++i) {
+        tx_invs.emplace_back(MSG_TX, ArithToUint256(arith_uint256{i}));
+    }
+    ProcessInvs(*m_node.peerman, *peer, {tx_invs.begin(), tx_invs.begin() + MAX_INV_SZ});
+    ProcessInvs(*m_node.peerman, *peer, {tx_invs.begin() + MAX_INV_SZ, tx_invs.end()});
+
+    // As many announcements as a peer may have pending are held, in INVs of MAX_INV_SZ
+    std::vector<CInv> vote_invs;
+    for (uint64_t i = 0; i < 2 * MAX_INV_SZ; ++i) {
+        vote_invs.emplace_back(MSG_GOVERNANCE_OBJECT_VOTE, ArithToUint256(arith_uint256{i}));
+        if (vote_invs.size() == MAX_INV_SZ) {
+            ProcessInvs(*m_node.peerman, *flooding_peer, vote_invs);
+            vote_invs.clear();
+        }
+    }
+    BOOST_CHECK(!flooding_peer->fDisconnect);
+    // One more can't be held, and the peer won't announce it again on this connection, so the peer is disconnected
+    // right away, before governance sync could ask it for anything that would stop a new connection from being asked
+    ProcessInv(*m_node.peerman, *flooding_peer, CInv{MSG_GOVERNANCE_OBJECT_VOTE, ArithToUint256(arith_uint256{2 * MAX_INV_SZ})});
+    BOOST_CHECK(flooding_peer->fDisconnect);
+    BOOST_CHECK(m_node.govman->IsCollateralSourceBehind());
+
+    // Still held after the index has synced while the blockchain isn't synced, which governance also waits for
+    m_collateral.synced = true;
+    m_node.mn_sync->Reset(/*fForce=*/true, /*fNotifyReset=*/false);
+    m_node.peerman->SendMessages(peer.get());
+    BOOST_CHECK_EQUAL(CountQueuedInventory(*peer, object_inv, NetMsgType::GETDATA), 0U);
+
+    // Once both have synced, it still waits while the peer has no room for another pending announcement
+    m_node.mn_sync->SwitchToNextAsset();
+    BOOST_REQUIRE(m_node.mn_sync->IsBlockchainSynced());
+    m_node.peerman->SendMessages(peer.get());
+    BOOST_CHECK_EQUAL(CountQueuedInventory(*peer, object_inv, NetMsgType::GETDATA), 0U);
+    BOOST_CHECK(!peer->fDisconnect);
+
+    // Then the object is requested from the same peer without it announcing the object again, and is rejected and
+    // punished
+    for (const CInv& tx_inv : tx_invs) {
+        WITH_LOCK(::cs_main, m_node.peerman->PeerForgetObjectRequest(tx_inv));
+    }
+    m_node.peerman->SendMessages(peer.get());
+    BOOST_CHECK_EQUAL(CountQueuedInventory(*peer, object_inv, NetMsgType::GETDATA), 1U);
+    ProcessGovernanceObject(net_gov, *peer, govobj);
+    BOOST_CHECK(!m_node.govman->HaveObjectForHash(govobj.GetHash()));
+    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 20);
+
+    BOOST_CHECK(!peer->fDisconnect);
+
+    m_node.peerman->FinalizeNode(*flooding_peer);
+    m_node.peerman->FinalizeNode(*peer);
+    chainstate.ResetIbd();
+}
+
 BOOST_AUTO_TEST_CASE(governance_votes_require_peer_announcement_or_request)
 {
     LOCK(NetEventsInterface::g_msgproc_mutex);
diff --git a/src/test/governance_vote_processing_tests.cpp b/src/test/governance_vote_processing_tests.cpp
index 57c05c103b8f..eb834ee8b4ec 100644
--- a/src/test/governance_vote_processing_tests.cpp
+++ b/src/test/governance_vote_processing_tests.cpp
@@ -8,7 +8,7 @@
 #include <governance/governance.h>
 #include <governance/object.h>
 #include <governance/vote.h>
-#include <index/txindex.h>
+#include <index/govcollateralindex.h>
 #include <interfaces/chain.h>
 #include <key.h>
 #include <key_io.h>
@@ -105,12 +105,13 @@ struct GovernanceVoteSetup : public TestChainSetup {
 
     void SetUp()
     {
-        // CGovernanceObject::IsCollateralValid() reads the proposal fee tx out of the tx index;
-        // without it no proposal can ever be accepted, orphan votes included.
-        g_txindex = std::make_unique<TxIndex>(interfaces::MakeChain(m_node), /*n_cache_size=*/1 << 20,
-                                              /*f_memory=*/true);
-        BOOST_REQUIRE(g_txindex->Start());
-        IndexWaitSynced(*g_txindex);
+        // CGovernanceObject::IsCollateralValid() reads the proposal fee tx out of the governance collateral
+        // index; without it no proposal can ever be accepted, orphan votes included.
+        SyncWithValidationInterfaceQueue();
+        m_node.gov_collateral_index = std::make_unique<GovCollateralIndex>(interfaces::MakeChain(m_node),
+                                                                           /*n_cache_size=*/0, /*f_memory=*/true);
+        BOOST_REQUIRE(m_node.gov_collateral_index->Start());
+        IndexWaitSynced(*m_node.gov_collateral_index);
 
         utxos = BuildSimpleUtxoMap(m_coinbase_txns);
 
@@ -131,9 +132,9 @@ struct GovernanceVoteSetup : public TestChainSetup {
         }
         BOOST_REQUIRE(m_node.mn_sync->IsSynced());
 
-        m_node.govman = std::make_unique<CGovernanceManager>(*m_node.mn_metaman, *m_node.chainman,
-                                                             *m_node.sbman, *m_node.dmnman,
-                                                             *m_node.mn_sync);
+        m_node.govman = std::make_unique<CGovernanceManager>(*m_node.mn_metaman, *m_node.chainman, *m_node.sbman,
+                                                             *m_node.dmnman, *m_node.mn_sync,
+                                                             m_node.gov_collateral_index.get());
         BOOST_REQUIRE(m_node.govman->LoadCache(/*load_cache=*/false));
 
         proposal_time = TicksSinceEpoch<std::chrono::seconds>(GetAdjustedTime());
@@ -147,10 +148,10 @@ struct GovernanceVoteSetup : public TestChainSetup {
         // govman holds a reference to node.sbman, so it must go first (matches PrepareShutdown
         // ordering in init.cpp).
         m_node.govman.reset();
-        if (g_txindex) {
+        if (m_node.gov_collateral_index) {
             SyncWithValidationInterfaceQueue();
-            g_txindex->Stop();
-            g_txindex.reset();
+            m_node.gov_collateral_index->Stop();
+            m_node.gov_collateral_index.reset();
         }
     }
 
@@ -169,7 +170,7 @@ struct GovernanceVoteSetup : public TestChainSetup {
         BOOST_REQUIRE_EQUAL(tip->GetBlockHash(), block.GetHash());
         m_node.dmnman->UpdatedBlockTip(tip);
         SetMockTime(GetTime() + 1);
-        IndexWaitSynced(*g_txindex);
+        IndexWaitSynced(*m_node.gov_collateral_index);
     }
 
     void MineBlocks(int num_blocks)
diff --git a/test/functional/feature_governance.py b/test/functional/feature_governance.py
index e544988f9ba8..9b2a0847c61a 100755
--- a/test/functional/feature_governance.py
+++ b/test/functional/feature_governance.py
@@ -2,28 +2,33 @@
 # Copyright (c) 2018-2025 The Dash Core developers
 # Distributed under the MIT software license, see the accompanying
 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
-"""Tests around dash governance."""
+"""Tests around dash governance.
+
+Node 1 is pruned, so it can't run -txindex and looks proposal collateral up in the governance collateral index.
+"""
 
 import json
+import os
+import shutil
 
-from test_framework.messages import uint256_to_string
+from test_framework.messages import CBlock, from_hex, uint256_to_string
 from test_framework.test_framework import (
     DashTestFramework,
     MasternodeInfo,
 )
-from test_framework.governance import have_trigger_for_height, prepare_object
-from test_framework.util import assert_equal, satoshi_round
+from test_framework.governance import EXPECTED_STDERR_GOV_PRUNED_TOO_FAR, have_trigger_for_height, prepare_object
+from test_framework.util import assert_equal, assert_raises_rpc_error, force_finish_mnsync, satoshi_round
 
 GOVERNANCE_UPDATE_MIN = 60 * 60 # src/governance/object.h
+MIN_BLOCKS_TO_KEEP = 288 # src/validation.h
+BUDGET_ARGS = ["-budgetparams=10:10:10"]
 
 class DashGovernanceTest (DashTestFramework):
     def add_options(self, parser):
         self.add_wallet_options(parser)
 
     def set_test_params(self):
-        self.set_dash_test_params(6, 5, [[
-            "-budgetparams=10:10:10",
-        ]] * 6)
+        self.set_dash_test_params(7, 5, [BUDGET_ARGS, BUDGET_ARGS + ["-prune=550", "-fastprune"]] + [BUDGET_ARGS] * 5)
         self.delay_v20_and_mn_rr(height=160)
 
     def check_superblockbudget(self, v20_active):
@@ -78,6 +83,24 @@ def count_own_trigger_votes(self, mns, trigger_hash):
             count += len(mn.get_node(self).gobject("getcurrentvotes", trigger_hash, collateral["collateralHash"], str(collateral["collateralIndex"])))
         return count
 
+    def check_budget_cannot_be_kept_by_the_miner(self, node):
+        """A superblock whose miner keeps the budget stays within the superblock limits, so only a node that knows
+        the trigger can tell it is invalid."""
+        self.bump_mocktime(1)
+        payment_scripts = {bytes.fromhex(payment["script"]) for payment in self.nodes[0].getblocktemplate()["superblock"]}
+        assert len(payment_scripts) > 0
+        miner_address = self.nodes[0].getnewaddress()
+        miner_script = bytes.fromhex(self.nodes[0].getaddressinfo(miner_address)["scriptPubKey"])
+        block = from_hex(CBlock(), self.generateblock(self.nodes[0], output=miner_address, transactions=[], submit=False)["hex"])
+        coinbase = block.vtx[0]
+        budget = sum(txout.nValue for txout in coinbase.vout if txout.scriptPubKey in payment_scripts)
+        coinbase.vout = [txout for txout in coinbase.vout if txout.scriptPubKey not in payment_scripts]
+        next(txout for txout in coinbase.vout if txout.scriptPubKey == miner_script).nValue += budget
+        coinbase.rehash()
+        block.hashMerkleRoot = block.calc_merkle_root()
+        block.solve()
+        assert_equal(node.submitblock(block.serialize().hex()), "bad-cb-amount")
+
     def run_test(self):
         self.log.info("Start testing...")
         governance_info = self.nodes[0].getgovernanceinfo()
@@ -113,6 +136,12 @@ def run_test(self):
 
         assert_equal(len(self.nodes[0].gobject("list-prepared")), 0)
 
+        pruned_node = self.nodes[1]
+        assert pruned_node.getblockchaininfo()["pruned"]
+        assert "txindex" not in pruned_node.getindexinfo()
+        # Funds a proposal on the pruned node
+        self.nodes[0].sendtoaddress(pruned_node.getnewaddress(), 10)
+
         self.log.info("Check 1st superblock before v20")
         self.bump_mocktime(3)
         self.generate(self.nodes[0], 2, sync_fun=self.sync_blocks())
@@ -139,6 +168,10 @@ def run_test(self):
         p0_collateral_prepare = prepare_object(self.nodes[0], 1, uint256_to_string(0), proposal_time, 1, "Proposal_0", self.p0_amount, self.p0_payout_address)
         p1_collateral_prepare = prepare_object(self.nodes[0], 1, uint256_to_string(0), proposal_time, 1, "Proposal_1", self.p1_amount, self.p1_payout_address)
         p2_collateral_prepare = prepare_object(self.nodes[0], 1, uint256_to_string(0), proposal_time, 1, "Proposal_2", self.p2_amount, self.p2_payout_address)
+        # The pruned node prepares a proposal too, but only submits it once the block with its collateral is pruned
+        assert_equal(pruned_node.getbalance(), 10)
+        p3_collateral_prepare = prepare_object(pruned_node, 1, uint256_to_string(0), proposal_time, 1, "Proposal_3", 1, pruned_node.getnewaddress())
+        self.sync_mempools([self.nodes[0], pruned_node])
 
         self.bump_mocktime(6)
         self.generate(self.nodes[0], 6, sync_fun=self.sync_blocks())
@@ -314,13 +347,22 @@ def sync_gov(node):
         self.log.info("let all fulfilled requests expire for re-sync to work correctly")
         self.bump_mocktime(5 * 60)
 
-        for node in self.nodes:
+        def resync_gov(node):
             # Force sync
             node.mnsync("reset")
             # fast-forward to governance sync
             node.mnsync("next")
             self.wait_until(lambda: sync_gov(node))
 
+        # Node 0 asks one peer every few seconds, so with the pruned node as an extra peer its governance sync would
+        # time out before it asks the reconnected payee. The pruned node syncs from node 0 afterwards instead.
+        self.disconnect_nodes(0, 1)
+        for node in self.nodes:
+            if node is not self.nodes[1]:
+                resync_gov(node)
+        self.connect_nodes(0, 1)
+        resync_gov(self.nodes[1])
+
         self.log.info("Should see two triggers now")
         self.wait_until(lambda: len(isolated.gobject("list", "valid", "triggers")) == 2, timeout=5)
         self.wait_until(lambda: len(self.nodes[0].gobject("list", "valid", "triggers")) == 2, timeout=5)
@@ -362,18 +404,19 @@ def yes_votes_known(node, trigger_hash, yes_count):
             assert_equal(node.gobject("count")["votes"], 25)
 
         self.log.info("Remember vote count")
-        before = self.nodes[1].gobject("count")["votes"]
+        mn_node = self.nodes[self.mninfo[0].nodeIdx]
+        before = mn_node.gobject("count")["votes"]
 
         self.log.info("Bump mocktime to let MNs vote again")
         self.bump_mocktime(GOVERNANCE_UPDATE_MIN + 1, update_schedulers=False)
 
         self.log.info("Move another block inside the Superblock maturity window")
-        with self.nodes[1].assert_debug_log(["VoteGovernanceTriggers --"]):
+        with mn_node.assert_debug_log(["VoteGovernanceTriggers --"]):
             self.bump_mocktime(1)
             self.generate(self.nodes[0], 1, sync_fun=self.sync_blocks())
 
         self.log.info("Vote count should not change even though MNs are allowed to vote again")
-        assert_equal(before, self.nodes[1].gobject("count")["votes"])
+        assert_equal(before, mn_node.gobject("count")["votes"])
         self.log.info("Revert mocktime back to avoid issues in tests below")
         self.bump_mocktime(GOVERNANCE_UPDATE_MIN * -1, update_schedulers=False)
 
@@ -392,7 +435,7 @@ def yes_votes_known(node, trigger_hash, yes_count):
 
         self.log.info("Move a few block past the recent superblock height and make sure we have no new votes")
         for _ in range(5):
-            with self.nodes[1].assert_debug_log(expected_msgs=[""], unexpected_msgs=[f"Voting NO-FUNDING for trigger:{winning_trigger_hash} success"]):
+            with mn_node.assert_debug_log(expected_msgs=[""], unexpected_msgs=[f"Voting NO-FUNDING for trigger:{winning_trigger_hash} success"]):
                 self.bump_mocktime(1)
                 self.generate(self.nodes[0], 1, sync_fun=self.sync_blocks())
             # Votes on both triggers should NOT change
@@ -414,9 +457,12 @@ def yes_votes_known(node, trigger_hash, yes_count):
             self.wait_until(lambda: have_trigger_for_height(self.nodes, 180), timeout=1, do_assert=False)
         self.log.info("Wait for new trigger and votes")
         self.wait_until(lambda: have_trigger_for_height(self.nodes, 180))
+        self.log.info("The pruned node checks superblock payments in full")
+        self.check_budget_cannot_be_kept_by_the_miner(pruned_node)
         self.log.info("Mine superblock")
-        self.bump_mocktime(1)
-        self.generate(self.nodes[0], 1, sync_fun=self.sync_blocks())
+        with pruned_node.assert_debug_log(["-- nOutputs = "], ["max bounds only"]):
+            self.bump_mocktime(1)
+            self.generate(self.nodes[0], 1, sync_fun=self.sync_blocks())
         assert_equal(self.nodes[0].getblockcount(), 180)
         assert_equal(self.nodes[0].getdeploymentinfo()["deployments"]["v20"]["active"], True)
 
@@ -439,6 +485,70 @@ def yes_votes_known(node, trigger_hash, yes_count):
             self.check_superblockbudget(True)
             self.check_superblock()
 
+        self.test_pruned_node(p3_collateral_prepare)
+
+    def test_pruned_node(self, proposal):
+        pruned_node = self.nodes[1]
+
+        def submit():
+            return pruned_node.gobject("submit", "0", 1, proposal["createdAt"], proposal["hex"], proposal["collateralHash"])
+
+        self.log.info("The pruned node finds collateral whose block it has pruned")
+        collateral_height = self.nodes[0].getrawtransaction(proposal["collateralHash"], True)["height"]
+        # Otherwise the masternodes keep creating triggers, and the burst of blocks below may leave out a superblock
+        # that one node already knows the trigger for but the other doesn't
+        for mn in self.mninfo:
+            self.isolate_node(mn.nodeIdx)
+        # Each -fastprune block file holds dozens of blocks, so mine enough to prune the collateral's whole file
+        self.bump_mocktime(MIN_BLOCKS_TO_KEEP + 150)
+        self.generate(self.nodes[0], MIN_BLOCKS_TO_KEEP + 150, sync_fun=lambda: self.sync_blocks(self.nodes[0:2]))
+        pruned_node.pruneblockchain(pruned_node.getblockcount() - MIN_BLOCKS_TO_KEEP)
+        assert pruned_node.getblockchaininfo()["pruneheight"] > collateral_height
+        assert_raises_rpc_error(-1, "Block not available (pruned data)", pruned_node.getblock,
+                                pruned_node.getblockhash(collateral_height))
+        proposal_hash = submit()
+        self.wait_until(lambda: proposal_hash in self.nodes[0].gobject("list", "valid", "proposals"))
+
+        self.log.info("Governance objects survive a restart of the pruned node")
+        self.restart_node(1)
+        force_finish_mnsync(pruned_node)
+        self.connect_nodes(0, 1)
+        assert proposal_hash in pruned_node.gobject("list", "valid", "proposals")
+        self.log.info("The reopened index still finds the pruned collateral")
+        self.wait_until(lambda: pruned_node.getindexinfo()["govcollateralindex"]["synced"])
+        assert_equal(submit(), proposal_hash)
+
+        self.log.info("A node that pruned before it had the index starts with governance off instead of failing")
+        self.stop_node(1)
+        shutil.rmtree(os.path.join(pruned_node.chain_path, "indexes", "govcollateralindex"))
+        self.start_node(1)
+        assert "govcollateralindex" not in pruned_node.getindexinfo()
+        self.stop_node(1, expected_stderr=EXPECTED_STDERR_GOV_PRUNED_TOO_FAR)
+
+        self.log.info("A -reindex downloads the chain again, builds the index and turns governance back on")
+        self.start_node(1, extra_args=self.extra_args[1] + ["-reindex"])
+        self.connect_nodes(0, 1)
+        self.sync_blocks(self.nodes[0:2])
+        assert pruned_node.getblockchaininfo()["pruned"]
+        self.wait_until(lambda: pruned_node.getindexinfo()["govcollateralindex"]["synced"])
+        self.bump_mocktime(5 * 60)
+
+        def governance_synced():
+            self.bump_mocktime(1)
+            return pruned_node.mnsync("status")["IsSynced"]
+        self.wait_until(governance_synced)
+        self.wait_until(lambda: proposal_hash in pruned_node.gobject("list", "valid", "proposals"))
+
+        self.log.info("The governance collateral index runs and finds collateral during -reindex-chainstate")
+        node = self.nodes[0]
+        height = node.getblockcount()
+        self.restart_node(0, extra_args=self.extra_args[0] + ["-reindex-chainstate"])
+        self.wait_until(lambda: node.getblockcount() == height)
+        self.wait_until(lambda: node.getindexinfo()["govcollateralindex"]["synced"])
+        force_finish_mnsync(node)
+        assert_equal(node.gobject("submit", "0", 1, proposal["createdAt"], proposal["hex"], proposal["collateralHash"]),
+                     proposal_hash)
+
 
 if __name__ == '__main__':
     DashGovernanceTest().main()
diff --git a/test/functional/feature_governance_txindex_devnet.py b/test/functional/feature_governance_txindex_devnet.py
deleted file mode 100755
index 6986bbfb2e50..000000000000
--- a/test/functional/feature_governance_txindex_devnet.py
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/usr/bin/env python3
-# Copyright (c) 2026 The Dash Core developers
-# Distributed under the MIT software license, see the accompanying
-# file COPYING or http://www.opensource.org/licenses/mit-license.php.
-"""Test that a node refuses to run governance validation without the transaction index outside regtest.
-
-Regtest exempts nodes from this check, so it is exercised on devnet here.
-"""
-
-from test_framework.governance import EXPECTED_STDERR_NO_GOV
-from test_framework.test_framework import BitcoinTestFramework
-
-
-class GovernanceTxindexDevnetTest(BitcoinTestFramework):
-    def set_test_params(self):
-        self.setup_clean_chain = True
-        self.chain = "devnet"
-        self.num_nodes = 1
-
-    def run_test(self):
-        self.stop_node(0)
-
-        self.log.info("Test that -txindex=0 is refused while governance validation is enabled")
-        self.nodes[0].assert_start_raises_init_error(
-            extra_args=["-txindex=0"],
-            expected_msg="Error: Transaction index can't be disabled with governance validation enabled. "
-                         "Either start with -disablegovernance command line switch or enable transaction index.")
-
-        self.log.info("Test that -txindex=0 is allowed together with -disablegovernance")
-        self.start_node(0, extra_args=["-txindex=0", "-disablegovernance"])
-        self.stop_node(0, expected_stderr=EXPECTED_STDERR_NO_GOV)
-
-
-if __name__ == '__main__':
-    GovernanceTxindexDevnetTest().main()
diff --git a/test/functional/feature_index_prune.py b/test/functional/feature_index_prune.py
index 95297694fa40..a538696c4b10 100755
--- a/test/functional/feature_index_prune.py
+++ b/test/functional/feature_index_prune.py
@@ -9,43 +9,47 @@
     assert_greater_than,
     assert_raises_rpc_error,
 )
-from test_framework.governance import EXPECTED_STDERR_NO_GOV_PRUNE
 
 DEPLOYMENT_ARGS = [
     "-dip3params=3000:3000",
     "-testactivationheight=v20@3000",
     "-testactivationheight=mn_rr@3000",
 ]
+PRUNE_ARGS = ["-fastprune", "-prune=1"]
 
 class FeatureIndexPruneTest(BitcoinTestFramework):
     def set_test_params(self):
         self.num_nodes = 5
         self.extra_args = [
-            ["-fastprune", "-prune=1", "-blockfilterindex=1"] + DEPLOYMENT_ARGS,
-            ["-fastprune", "-prune=1", "-coinstatsindex=1"] + DEPLOYMENT_ARGS,
-            ["-fastprune", "-prune=1", "-blockfilterindex=1", "-coinstatsindex=1"] + DEPLOYMENT_ARGS,
-            ["-fastprune", "-prune=1", "-timestampindex"] + DEPLOYMENT_ARGS,
+            PRUNE_ARGS + ["-blockfilterindex=1"] + DEPLOYMENT_ARGS,
+            PRUNE_ARGS + ["-coinstatsindex=1"] + DEPLOYMENT_ARGS,
+            PRUNE_ARGS + ["-blockfilterindex=1", "-coinstatsindex=1"] + DEPLOYMENT_ARGS,
+            PRUNE_ARGS + ["-timestampindex"] + DEPLOYMENT_ARGS,
             [] + DEPLOYMENT_ARGS,
         ]
 
     def sync_index(self, height):
+        # The governance collateral index always runs
+        expected_gov = {
+            'govcollateralindex': {'synced': True, 'best_block_height': height},
+        }
         expected_filter = {
             'basic block filter index': {'synced': True, 'best_block_height': height},
         }
-        self.wait_until(lambda: self.nodes[0].getindexinfo() == expected_filter)
+        self.wait_until(lambda: self.nodes[0].getindexinfo() == {**expected_gov, **expected_filter})
 
         expected_stats = {
             'coinstatsindex': {'synced': True, 'best_block_height': height}
         }
-        self.wait_until(lambda: self.nodes[1].getindexinfo() == expected_stats)
+        self.wait_until(lambda: self.nodes[1].getindexinfo() == {**expected_gov, **expected_stats})
 
-        expected = {**expected_filter, **expected_stats}
+        expected = {**expected_gov, **expected_filter, **expected_stats}
         self.wait_until(lambda: self.nodes[2].getindexinfo() == expected)
 
         expected_timestamp = {
             'timestampindex': {'synced': True, 'best_block_height': height}
         }
-        self.wait_until(lambda: self.nodes[3].getindexinfo() == expected_timestamp)
+        self.wait_until(lambda: self.nodes[3].getindexinfo() == {**expected_gov, **expected_timestamp})
 
     def reconnect_nodes(self):
         self.connect_nodes(0,1)
@@ -61,7 +65,7 @@ def mine_batches(self, blocks):
 
     def restart_without_indices(self):
         for i in range(4):
-            self.restart_node(i, extra_args=["-fastprune", "-prune=1"] + DEPLOYMENT_ARGS, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+            self.restart_node(i, extra_args=PRUNE_ARGS + DEPLOYMENT_ARGS)
         self.reconnect_nodes()
 
     def assert_timestampindex_covers(self, height):
@@ -134,7 +138,7 @@ def run_test(self):
             pruneheight_2 = self.nodes[i].pruneblockchain(1000)
             assert_equal(pruneheight_2, 735)
             # Restart the nodes again with the indices activated
-            self.restart_node(i, extra_args=self.extra_args[i], expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+            self.restart_node(i, extra_args=self.extra_args[i])
 
         self.log.info("make sure that we can continue with the partially synced indices after having pruned up to the index height")
         self.sync_index(height=1500)
@@ -146,7 +150,7 @@ def run_test(self):
         for i in range(4):
             pruneheight_3 = self.nodes[i].pruneblockchain(2000)
             assert_greater_than(pruneheight_3, pruneheight_2)
-            self.stop_node(i, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+            self.stop_node(i)
 
         self.log.info("make sure we get an init error when starting the nodes again with the indices")
         filter_msg = "Error: basic block filter index best block of the index goes beyond pruned data. Please disable the index or reindex (which will download the whole blockchain again)"
@@ -154,12 +158,12 @@ def run_test(self):
         timestamp_msg = "Error: timestampindex best block of the index goes beyond pruned data. Please disable the index or reindex (which will download the whole blockchain again)"
         # Node 2 has both blockfilter and coinstats indexes; the blockfilter init runs first and produces the error.
         for i, msg in enumerate([filter_msg, stats_msg, filter_msg, timestamp_msg]):
-            self.nodes[i].assert_start_raises_init_error(extra_args=self.extra_args[i], expected_msg=f"{EXPECTED_STDERR_NO_GOV_PRUNE}\n{msg}")
+            self.nodes[i].assert_start_raises_init_error(extra_args=self.extra_args[i], expected_msg=msg)
 
         self.log.info("make sure the nodes start again with the indices and an additional -reindex arg")
         for i in range(4):
             restart_args = self.extra_args[i]+["-reindex"]
-            self.restart_node(i, extra_args=restart_args, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+            self.restart_node(i, extra_args=restart_args)
             # The nodes need to be reconnected to the non-pruning node upon restart, otherwise they will be stuck
             self.connect_nodes(i, 4)
 
@@ -177,7 +181,7 @@ def run_test(self):
             self.generate(self.nodes[4], 30)
 
         for idx in range(self.num_nodes):
-            self.nodes[idx].stop_node(expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE if idx != 4 else "")
+            self.nodes[idx].stop_node()
 
         self.log.info("ensure -prune is incompatible with -addressindex and -spentindex at startup")
         # Reuse the unrestricted control node datadir for these init-error checks; -prune
diff --git a/test/functional/feature_pruning.py b/test/functional/feature_pruning.py
index c6ea4be253fd..b4d9d4edaeff 100755
--- a/test/functional/feature_pruning.py
+++ b/test/functional/feature_pruning.py
@@ -14,10 +14,6 @@
     create_block,
     create_coinbase,
 )
-from test_framework.governance import (
-    EXPECTED_STDERR_NO_GOV,
-    EXPECTED_STDERR_NO_GOV_PRUNE,
-)
 from test_framework.script import (
     CScript,
     OP_NOP,
@@ -92,10 +88,10 @@ def set_test_params(self):
         self.extra_args = [
             self.full_node_default_args,
             self.full_node_default_args,
-            ["-disablegovernance","-txindex=0","-maxreceivebuffer=20000","-prune=550"] + DEPLOYMENT_ARGS,
-            ["-disablegovernance","-txindex=0","-maxreceivebuffer=20000","-blockmaxsize=999000"] + DEPLOYMENT_ARGS,
-            ["-disablegovernance","-txindex=0","-maxreceivebuffer=20000","-blockmaxsize=999000"] + DEPLOYMENT_ARGS,
-            ["-disablegovernance","-txindex=0","-prune=550", "-blockfilterindex=1"] + DEPLOYMENT_ARGS,
+            ["-txindex=0","-maxreceivebuffer=20000","-prune=550"] + DEPLOYMENT_ARGS,
+            ["-txindex=0","-maxreceivebuffer=20000","-blockmaxsize=999000"] + DEPLOYMENT_ARGS,
+            ["-txindex=0","-maxreceivebuffer=20000","-blockmaxsize=999000"] + DEPLOYMENT_ARGS,
+            ["-txindex=0","-prune=550", "-blockfilterindex=1"] + DEPLOYMENT_ARGS,
         ]
         self.rpc_timeout = 120
 
@@ -128,10 +124,10 @@ def create_big_chain(self):
         self.sync_blocks(self.nodes[0:5])
 
     def test_invalid_command_line_options(self):
-        self.stop_node(0, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.stop_node(0)
         self.nodes[0].assert_start_raises_init_error(
             expected_msg='Error: Prune cannot be configured with a negative value.',
-            extra_args=['-prune=-1', '-txindex=0', '-disablegovernance'],
+            extra_args=['-prune=-1', '-txindex=0'],
         )
         self.nodes[0].assert_start_raises_init_error(
             expected_msg='Error: Prune configured below the minimum of 550 MiB.  Please use a higher number.',
@@ -145,10 +141,6 @@ def test_invalid_command_line_options(self):
             expected_msg='Error: Prune mode is incompatible with -reindex-chainstate. Use full -reindex instead.',
             extra_args=['-prune=550', '-reindex-chainstate'],
         )
-        self.nodes[0].assert_start_raises_init_error(
-            expected_msg='Error: Prune mode is incompatible with -disablegovernance=false.',
-            extra_args=['-prune=550', '-disablegovernance=false'],
-        )
 
     def test_rescan_blockchain(self):
         self.restart_node(0, ["-prune=550"] + DEPLOYMENT_ARGS)
@@ -286,13 +278,13 @@ def reorg_back(self):
 
     def manual_test(self, node_number, use_timestamp):
         # at this point, node has 995 blocks and has not yet run in prune mode
-        self.start_node(node_number, extra_args=["-disablegovernance", "-txindex=0"] + DEPLOYMENT_ARGS)
+        self.start_node(node_number, extra_args=["-txindex=0"] + DEPLOYMENT_ARGS)
         node = self.nodes[node_number]
         assert_equal(node.getblockcount(), 995)
         assert_raises_rpc_error(-1, "Cannot prune blocks because node is not in prune mode", node.pruneblockchain, 500)
 
         # now re-start in manual pruning mode
-        self.restart_node(node_number, extra_args=["-disablegovernance", "-txindex=0", "-prune=1"] + DEPLOYMENT_ARGS, expected_stderr=EXPECTED_STDERR_NO_GOV)
+        self.restart_node(node_number, extra_args=["-txindex=0", "-prune=1"] + DEPLOYMENT_ARGS)
         node = self.nodes[node_number]
         assert_equal(node.getblockcount(), 995)
 
@@ -361,21 +353,21 @@ def has_block(index):
         assert not has_block(3), "blk00003.dat is still there, should be pruned by now"
 
         # stop node, start back up with auto-prune at 550 MiB, make sure still runs
-        self.restart_node(node_number, extra_args=["-disablegovernance", "-txindex=0", "-prune=550"] + DEPLOYMENT_ARGS, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.restart_node(node_number, extra_args=["-txindex=0", "-prune=550"] + DEPLOYMENT_ARGS)
 
         self.log.info("Success")
 
     def test_wallet_rescan(self):
         # check that the pruning node's wallet is still in good shape
         self.log.info("Stop and start pruning node to trigger wallet rescan")
-        self.restart_node(2, extra_args=["-disablegovernance", "-txindex=0", "-prune=550"] + DEPLOYMENT_ARGS, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.restart_node(2, extra_args=["-txindex=0", "-prune=550"] + DEPLOYMENT_ARGS)
 
         self.wait_until(lambda: self.nodes[2].getwalletinfo()["scanning"] == False)
         self.wait_until(lambda: self.nodes[2].getwalletinfo()["lastprocessedblock"]["height"] == self.nodes[2].getblockcount())
 
         # check that wallet loads successfully when restarting a pruned node after IBD.
         # this was reported to fail in #7494.
-        self.restart_node(5, extra_args=["-disablegovernance", "-txindex=0", "-prune=550", "-blockfilterindex=1"] + DEPLOYMENT_ARGS, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE) # restart to trigger rescan
+        self.restart_node(5, extra_args=["-txindex=0", "-prune=550", "-blockfilterindex=1"] + DEPLOYMENT_ARGS) # restart to trigger rescan
 
         self.wait_until(lambda: self.nodes[5].getwalletinfo()["scanning"] == False)
         self.wait_until(lambda: self.nodes[5].getwalletinfo()["lastprocessedblock"]["height"] == self.nodes[0].getblockcount())
@@ -395,8 +387,8 @@ def run_test(self):
         # N0=N1=N2 **...*(995)
 
         # stop manual-pruning node with 995 blocks
-        self.stop_node(3, expected_stderr=EXPECTED_STDERR_NO_GOV)
-        self.stop_node(4, expected_stderr=EXPECTED_STDERR_NO_GOV)
+        self.stop_node(3)
+        self.stop_node(4)
 
         self.log.info("Check that we haven't started pruning yet because we're below PruneAfterHeight")
         self.test_height_min()
@@ -506,7 +498,7 @@ def run_test(self):
         self.log.info("Stopping pruned nodes manually")
         for i in range(2, 6):
             self.log.info("Stopping pruned node%d" % i)
-            self.stop_node(i, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+            self.stop_node(i)
 
         self.log.info("Done")
 
diff --git a/test/functional/feature_remove_pruned_files_on_startup.py b/test/functional/feature_remove_pruned_files_on_startup.py
index 49b6be7bda44..a291a95a25f8 100755
--- a/test/functional/feature_remove_pruned_files_on_startup.py
+++ b/test/functional/feature_remove_pruned_files_on_startup.py
@@ -6,7 +6,6 @@
 
 import platform
 import os
-from test_framework.governance import EXPECTED_STDERR_NO_GOV_PRUNE
 from test_framework.test_framework import BitcoinTestFramework
 
 class FeatureRemovePrunedFilesOnStartupTest(BitcoinTestFramework):
@@ -48,10 +47,10 @@ def run_test(self):
         # Check that the files are removed on restart once the fds are closed
         fd1.close()
         fd2.close()
-        self.restart_node(0, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.restart_node(0)
         assert not os.path.exists(blk0)
         assert not os.path.exists(rev1)
-        self.stop_node(0, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.stop_node(0)
 
 if __name__ == '__main__':
     FeatureRemovePrunedFilesOnStartupTest().main()
diff --git a/test/functional/interface_rest.py b/test/functional/interface_rest.py
index 0e352c9d5e34..fd4564f79583 100755
--- a/test/functional/interface_rest.py
+++ b/test/functional/interface_rest.py
@@ -291,6 +291,7 @@ def run_test(self):
         self.generate(self.nodes[1], 5)
         expected_filter = {
             'txindex': {'synced': True, 'best_block_height': 208},
+            'govcollateralindex': {'synced': True, 'best_block_height': 208},
             'basic block filter index': {'synced': True, 'best_block_height': 208},
         }
         self.wait_until(lambda: self.nodes[0].getindexinfo() == expected_filter)
diff --git a/test/functional/interface_usdt_utxocache.py b/test/functional/interface_usdt_utxocache.py
index 338c9e589b43..2874edc2f2ea 100755
--- a/test/functional/interface_usdt_utxocache.py
+++ b/test/functional/interface_usdt_utxocache.py
@@ -14,7 +14,6 @@
 except ImportError:
     pass
 from test_framework.messages import COIN
-from test_framework.governance import EXPECTED_STDERR_NO_GOV_PRUNE
 from test_framework.test_framework import BitcoinTestFramework
 from test_framework.util import assert_equal
 from test_framework.wallet import MiniWallet
@@ -412,7 +411,7 @@ def handle_utxocache_flush(_, data, __):
         assert_equal(0, len(possible_cache_sizes))
         assert_equal(EXPECTED_HANDLE_FLUSH_SUCCESS, handle_flush_succeeds)
 
-        self.stop_node(0, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.stop_node(0)
 
 if __name__ == '__main__':
     UTXOCacheTracepointTest().main()
diff --git a/test/functional/p2p_dos_header_tree.py b/test/functional/p2p_dos_header_tree.py
index 7f5be596055e..2c6b658dd433 100755
--- a/test/functional/p2p_dos_header_tree.py
+++ b/test/functional/p2p_dos_header_tree.py
@@ -6,7 +6,6 @@
 
 from test_framework.blocktools import filter_tip_keys
 
-from test_framework.governance import EXPECTED_STDERR_NO_GOV_PRUNE
 from test_framework.messages import (
     CBlockHeader,
     from_hex,
@@ -66,7 +65,7 @@ def run_test(self):
 
         self.log.info("Feed all fork headers (succeeds without checkpoint)")
         # On node 0 it succeeds because checkpoints are disabled
-        self.restart_node(0, extra_args=['-nocheckpoints', '-prune=945'], expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.restart_node(0, extra_args=['-nocheckpoints', '-prune=945'])
         peer_no_checkpoint = self.nodes[0].add_p2p_connection(P2PInterface())
         peer_no_checkpoint.send_and_ping(msg_headers(self.headers_fork))
         assert {
@@ -87,7 +86,7 @@ def run_test(self):
         } in filter_tip_keys(self.nodes[0].getchaintips())
 
         for idx in range(self.num_nodes):
-            self.nodes[idx].stop_node(expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+            self.nodes[idx].stop_node()
 
 if __name__ == '__main__':
     RejectLowDifficultyHeadersTest().main()
diff --git a/test/functional/p2p_node_network_limited.py b/test/functional/p2p_node_network_limited.py
index c72525c8c4ff..6c49bb521f00 100755
--- a/test/functional/p2p_node_network_limited.py
+++ b/test/functional/p2p_node_network_limited.py
@@ -17,7 +17,6 @@
     NODE_P2P_V2,
     msg_getdata,
 )
-from test_framework.governance import EXPECTED_STDERR_NO_GOV_PRUNE
 from test_framework.p2p import P2PInterface
 from test_framework.test_framework import BitcoinTestFramework
 from test_framework.util import assert_equal
@@ -110,7 +109,7 @@ def run_test(self):
 
         # sync must be possible, node 1 is no longer in IBD and should therefore connect to node 0 (NODE_NETWORK_LIMITED)
         self.sync_blocks([self.nodes[0], self.nodes[1]])
-        self.stop_node(0, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.stop_node(0)
 
 
 if __name__ == '__main__':
diff --git a/test/functional/rpc_blockchain.py b/test/functional/rpc_blockchain.py
index 76ca67e6e9a6..c91bbb89bd35 100755
--- a/test/functional/rpc_blockchain.py
+++ b/test/functional/rpc_blockchain.py
@@ -34,7 +34,6 @@
     create_block,
     create_coinbase,
 )
-from test_framework.governance import EXPECTED_STDERR_NO_GOV_PRUNE
 from test_framework.messages import (
     CBlockHeader,
     dashhash,
@@ -113,10 +112,10 @@ def _test_prune_disk_space(self):
                       "integer overflow on first start up")
         self.restart_node(0, extra_args=["-prune=1"])
         self.log.info("Avoid warning when assumed chain size is enough")
-        self.restart_node(0, extra_args=["-prune=123456789"], expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.restart_node(0, extra_args=["-prune=123456789"])
 
     def _test_max_future_block_time(self):
-        self.stop_node(0, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.stop_node(0)
         self.log.info("A block tip of more than MAX_FUTURE_BLOCK_TIME in the future raises an error")
         self.nodes[0].assert_start_raises_init_error(
             extra_args=[f"-mocktime={TIME_RANGE_TIP - MAX_FUTURE_BLOCK_TIME - 1}"],
@@ -164,7 +163,7 @@ def _test_getblockchaininfo(self):
         assert res['pruned']
         assert not res['automatic_pruning']
 
-        self.restart_node(0, ['-stopatheight=207', '-txindex=0'], expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.restart_node(0, ['-stopatheight=207', '-txindex=0'])
         res = self.nodes[0].getblockchaininfo()
         # should have exact keys
         assert_equal(sorted(res.keys()), keys)
@@ -546,7 +545,7 @@ def _test_stopatheight(self):
         except (ConnectionError, http.client.BadStatusLine):
             pass  # The node already shut down before response
         self.log.debug('Node should stop at this height...')
-        self.nodes[0].wait_until_stopped(expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.nodes[0].wait_until_stopped()
         self.start_node(0, ['-txindex=0'])
         assert_equal(self.nodes[0].getblockcount(), HEIGHT + 7)
 
diff --git a/test/functional/rpc_getblockfrompeer.py b/test/functional/rpc_getblockfrompeer.py
index c45ca69f0f6c..b214a3b8f74c 100755
--- a/test/functional/rpc_getblockfrompeer.py
+++ b/test/functional/rpc_getblockfrompeer.py
@@ -5,7 +5,6 @@
 """Test the getblockfrompeer RPC."""
 
 from test_framework.authproxy import JSONRPCException
-from test_framework.governance import EXPECTED_STDERR_NO_GOV_PRUNE
 from test_framework.messages import (
     CBlock,
     from_hex,
@@ -108,7 +107,7 @@ def run_test(self):
         # Trying to fetch this block from the P2PInterface should not be possible
         error_msg = "In prune mode, only blocks that the node has already synced previously can be fetched from a peer"
         assert_raises_rpc_error(-1, error_msg, self.nodes[1].getblockfrompeer, blockhash, node1_interface_id)
-        self.stop_node(1, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.stop_node(1)
 
         self.log.info("Connect pruned node")
         self.connect_nodes(0, 2)
@@ -153,7 +152,7 @@ def run_test(self):
         self.sync_blocks([self.nodes[0], pruned_node])
         assert_greater_than(pruned_node.pruneblockchain(tip_at_fetch + 1000), tip_at_fetch)
         assert_raises_rpc_error(-1, "Block not available (pruned data)", pruned_node.getblock, pruned_block)
-        self.stop_node(2, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.stop_node(2)
 
 
 if __name__ == '__main__':
diff --git a/test/functional/rpc_misc.py b/test/functional/rpc_misc.py
index 37153a2161fb..a7e9bd74e08c 100755
--- a/test/functional/rpc_misc.py
+++ b/test/functional/rpc_misc.py
@@ -82,8 +82,8 @@ def run_test(self):
 
         self.log.info("test getindexinfo")
         self.restart_node(0, ["-txindex=0", "-blockfilterindex=0", "-peerblockfilters=0"])
-        # Without any indices running the RPC returns an empty object
-        assert_equal(node.getindexinfo(), {})
+        # Without any optional indices running, only the governance collateral index is returned
+        assert_equal(list(node.getindexinfo()), ["govcollateralindex"])
 
         # Restart the node with indices and wait for them to sync
         self.restart_node(0, ["-txindex", "-blockfilterindex", "-coinstatsindex",
@@ -101,11 +101,12 @@ def run_test(self):
                 "addressindex": values,
                 "timestampindex": values,
                 "spentindex": values,
+                "govcollateralindex": values,
             }
         )
         # Specifying an index by name returns only the status of that index
         for i in {"txindex", "basic block filter index", "coinstatsindex",
-                  "addressindex", "timestampindex", "spentindex"}:
+                  "addressindex", "timestampindex", "spentindex", "govcollateralindex"}:
             assert_equal(node.getindexinfo(i), {i: values})
 
         # Specifying an unknown index name returns an empty result
diff --git a/test/functional/rpc_rawtransaction.py b/test/functional/rpc_rawtransaction.py
index 49beb62cf6df..748f154f49e7 100755
--- a/test/functional/rpc_rawtransaction.py
+++ b/test/functional/rpc_rawtransaction.py
@@ -16,7 +16,6 @@
 from decimal import Decimal
 from itertools import product
 
-from test_framework.governance import EXPECTED_STDERR_NO_GOV_PRUNE
 from test_framework.messages import (
     COIN,
     CTransaction,
@@ -94,7 +93,7 @@ def run_test(self):
             self.import_deterministic_coinbase_privkeys()
             self.raw_multisig_transaction_legacy_tests()
         self.getrawtransaction_verbosity_tests()
-        self.stop_node(2, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.stop_node(2)
 
 
     def getrawtransaction_tests(self):
diff --git a/test/functional/test_framework/governance.py b/test/functional/test_framework/governance.py
index 9eb46081fb2e..3a772cb66419 100644
--- a/test/functional/test_framework/governance.py
+++ b/test/functional/test_framework/governance.py
@@ -7,7 +7,10 @@
 import json
 
 EXPECTED_STDERR_NO_GOV = "Warning: You are starting with governance validation disabled."
-EXPECTED_STDERR_NO_GOV_PRUNE = f"{EXPECTED_STDERR_NO_GOV} This is expected because you are running a pruned node."
+EXPECTED_STDERR_GOV_PRUNED_TOO_FAR = (
+    "Warning: Governance is disabled because this node has already pruned the old blocks it needs to build "
+    "the governance collateral index. Restart once with -reindex to enable governance; the blockchain will be "
+    "downloaded again but the node stays pruned.")
 
 def prepare_object(node, object_type, parent_hash, creation_time, revision, name, amount, payment_address):
     proposal_rev = revision
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index 6c8c8de4647f..a93eabc0df10 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -344,7 +344,6 @@
     'p2p_compactblocks_blocksonly.py',
     'p2p_mutated_blocks.py', # NOTE: needs dash_hash to pass
     'p2p_connect_to_devnet.py',
-    'feature_governance_txindex_devnet.py',
     'feature_sporks.py',
     'rpc_getblockstats.py',
     'feature_bind_port_externalip.py',
diff --git a/test/functional/wallet_crosschain.py b/test/functional/wallet_crosschain.py
index 5834c56d3a8c..244f80fcb96b 100755
--- a/test/functional/wallet_crosschain.py
+++ b/test/functional/wallet_crosschain.py
@@ -5,7 +5,6 @@
 
 import os
 
-from test_framework.governance import EXPECTED_STDERR_NO_GOV_PRUNE
 from test_framework.test_framework import BitcoinTestFramework
 from test_framework.util import assert_raises_rpc_error
 
@@ -58,14 +57,14 @@ def run_test(self):
 
         if not self.options.descriptors:
             self.log.info("Override cross-chain wallet load protection")
-            self.nodes[1].stop_node(expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+            self.nodes[1].stop_node()
             self.stop_nodes()
             self.start_nodes([['-walletcrosschain', '-prune=945']] * self.num_nodes)
             self.nodes[0].loadwallet(node1_wallet)
             self.nodes[1].loadwallet(node0_wallet)
 
         for idx in range(self.num_nodes):
-            self.nodes[idx].stop_node(expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE if not self.options.descriptors or (self.options.descriptors and idx == 1) else "")
+            self.nodes[idx].stop_node()
 
 if __name__ == '__main__':
     WalletCrossChain().main()
diff --git a/test/functional/wallet_pruning.py b/test/functional/wallet_pruning.py
index 0dcdfde8b7ba..bcbe9efb2c88 100755
--- a/test/functional/wallet_pruning.py
+++ b/test/functional/wallet_pruning.py
@@ -12,7 +12,6 @@
     create_block
 )
 from test_framework.blocktools import create_coinbase
-from test_framework.governance import EXPECTED_STDERR_NO_GOV_PRUNE
 from test_framework.test_framework import BitcoinTestFramework
 
 from test_framework.script import (
@@ -164,7 +163,7 @@ def run_test(self):
         self.test_wallet_import_pruned(wallet_birthheight_2)
         self.test_wallet_import_pruned_with_missing_blocks(wallet_birthheight_1)
 
-        self.stop_node(1, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+        self.stop_node(1)
 
 if __name__ == '__main__':
     WalletPruningTest().main()
diff --git a/test/lint/lint-circular-dependencies.py b/test/lint/lint-circular-dependencies.py
index d77e213722c7..0ea1371a98e6 100755
--- a/test/lint/lint-circular-dependencies.py
+++ b/test/lint/lint-circular-dependencies.py
@@ -31,6 +31,7 @@
     "index/addressindex -> index/base -> node/context -> index/addressindex",
     "index/base -> node/context -> index/spentindex -> index/base",
     "index/base -> node/context -> index/timestampindex -> index/base",
+    "index/base -> node/context -> index/govcollateralindex -> index/base",
     "banman -> common/bloom -> evo/assetlocktx -> llmq/quorumsman -> llmq/blockprocessor -> net -> banman",
     "coinjoin/client -> coinjoin/util -> wallet/wallet -> psbt -> node/transaction -> net_processing -> coinjoin/walletman -> coinjoin/client",
     "common/bloom -> evo/assetlocktx -> llmq/commitment -> evo/deterministicmns -> evo/simplifiedmns -> merkleblock -> common/bloom",

From f2ade38fab5a7c7d1371705e760e5cc8ca13859e Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Tue, 13 Oct 2026 22:01:59 -0500
Subject: [PATCH 5/5] fix(governance): refuse proposals early on nodes that
 can't check them

gobject prepare burned the proposal fee on nodes that could never submit
the proposal, and gobject submit then failed with only "Invalid proposal
collateral". Make gobject prepare and gobject submit, and the Qt
createProposal/submitProposal interfaces, refuse up front when governance
is disabled or the governance collateral index isn't running, and say why
and what to do. Keep the collateral error detail in IsValidLocally, and
say in the gobject check help that it only checks the proposal data.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 doc/release-notes-7860.md             |  7 +++++++
 src/governance/object.cpp             |  2 +-
 src/node/interfaces.cpp               | 16 ++++++++++++++++
 src/rpc/governance.cpp                | 24 +++++++++++++++++++++++-
 test/functional/feature_governance.py |  7 +++++++
 5 files changed, 54 insertions(+), 2 deletions(-)

diff --git a/doc/release-notes-7860.md b/doc/release-notes-7860.md
index 08fec1963c9b..9f7a1807eca1 100644
--- a/doc/release-notes-7860.md
+++ b/doc/release-notes-7860.md
@@ -23,6 +23,13 @@ Governance
   was turned on in the options. That setting stays until it is removed, so
   governance stays off on those nodes.
 
+- `gobject prepare` and `gobject submit` now fail straight away on a node that
+  can't check or relay proposals. Before, `gobject prepare` burned the
+  proposal fee and only `gobject submit` failed afterwards, with the
+  misleading error `Invalid proposal collateral`. Collateral errors now also
+  say what is wrong with the collateral instead of only
+  `Invalid proposal collateral`.
+
 - Pruned nodes now check superblock payments against the governance
   triggers they know, like full nodes do, instead of only checking that a
   superblock stays within the budget.
diff --git a/src/governance/object.cpp b/src/governance/object.cpp
index 619342bce588..6e7f161d55f2 100644
--- a/src/governance/object.cpp
+++ b/src/governance/object.cpp
@@ -727,7 +727,7 @@ bool CGovernanceObject::IsValidLocally(const CDeterministicMNList& tip_mn_list,
             return false;
         }
         if (fCheckCollateral && !IsCollateralValid(collateral, chainman, strError, fMissingConfirmations)) {
-            strError = "Invalid proposal collateral";
+            strError = "Invalid proposal collateral: " + strError;
             return false;
         }
         return true;
diff --git a/src/node/interfaces.cpp b/src/node/interfaces.cpp
index 7781e4e27e72..b330c2590c84 100644
--- a/src/node/interfaces.cpp
+++ b/src/node/interfaces.cpp
@@ -495,6 +495,14 @@ class GOVImpl : public GOV
     std::optional<CGovernanceObject> createProposal(int32_t revision, int64_t created_time,
                         const std::string& data_hex, std::string& error) override
     {
+        if (!context().govman || !context().govman->IsValid() || !context().gov_collateral_index) {
+            error = "Governance is disabled on this node, so it can't submit proposals";
+            return std::nullopt;
+        }
+        if (!context().gov_collateral_index->BlockUntilSyncedToCurrentChain()) {
+            error = "This node is still building its governance collateral index, so it can't submit proposals yet";
+            return std::nullopt;
+        }
         CGovernanceObject govobj(uint256{}, revision, created_time, uint256{}, data_hex);
         if (govobj.GetObjectType() != GovernanceObject::PROPOSAL) {
             error = "Invalid object type, only proposals can be validated";
@@ -522,6 +530,14 @@ class GOVImpl : public GOV
                         const uint256& fee_txid, std::string& out_object_hash, std::string& error) override
     {
         if (!context().govman || !context().dmnman || !context().chainman) { error = "Governance not available"; return false; }
+        if (!context().govman->IsValid() || !context().gov_collateral_index) {
+            error = "Governance is disabled on this node, so it can't submit proposals";
+            return false;
+        }
+        if (!context().gov_collateral_index->BlockUntilSyncedToCurrentChain()) {
+            error = "This node is still building its governance collateral index, so it can't submit proposals yet";
+            return false;
+        }
         if(!Assert(context().mn_sync)->IsBlockchainSynced()) { error = "Client not synced"; return false; }
         const auto mnList = Assert(context().dmnman)->GetListAtChainTip();
         CGovernanceObject govobj(parent, revision, created_time, fee_txid, data_hex);
diff --git a/src/rpc/governance.cpp b/src/rpc/governance.cpp
index 12253689a490..1dc0ecdba30f 100644
--- a/src/rpc/governance.cpp
+++ b/src/rpc/governance.cpp
@@ -65,6 +65,22 @@ static void BlockUntilCollateralIndexSynced(const NodeContext& node)
     }
 }
 
+//! Checking and relaying a proposal needs governance and an index to find its collateral in.
+static void EnsureCanSubmitProposals(const NodeContext& node, const std::string& consequence)
+{
+    if (!CHECK_NONFATAL(node.govman)->IsValid() || !node.gov_collateral_index) {
+        throw JSONRPCError(RPC_MISC_ERROR,
+                           "Governance is disabled on this node, so it can't check or relay proposals. Restart without "
+                           "-disablegovernance, or once with -reindex if the node warned that it has already pruned "
+                           "the blocks the governance collateral index needs. " + consequence);
+    }
+    if (!node.gov_collateral_index->BlockUntilSyncedToCurrentChain()) {
+        throw JSONRPCError(RPC_MISC_ERROR, "This node is still building its governance collateral index (see "
+                                           "getindexinfo), so it can't look up proposal collateral yet. Try again "
+                                           "once the index has synced.");
+    }
+}
+
 static RPCHelpMan gobject_count()
 {
     const auto json_help{CGovernanceManager::GetJsonHelp(/*key=*/"", /*optional=*/false)};
@@ -125,7 +141,8 @@ static RPCHelpMan gobject_deserialize()
 static RPCHelpMan gobject_check()
 {
     return RPCHelpMan{"gobject check",
-        "Validate governance object data (proposal only)\n",
+        "Validate governance object data (proposal only)\n"
+        "This only checks the proposal data. It does not check the collateral or whether this node can submit the proposal.\n",
         {
             {"hex_data", RPCArg::Type::STR_HEX, RPCArg::Optional::NO, "data in hex string format"},
         },
@@ -190,6 +207,9 @@ static RPCHelpMan gobject_prepare()
     std::shared_ptr<CWallet> const wallet = GetWalletForJSONRPCRequest(request);
     if (!wallet) return UniValue::VNULL;
 
+    EnsureCanSubmitProposals(EnsureAnyNodeContext(request.context),
+                             "Preparing a proposal now would burn its fee with no way to submit it from this node.");
+
     EnsureWalletIsUnlocked(*wallet);
 
     // ASSEMBLE NEW GOVERNANCE OBJECT FROM USER PARAMETERS
@@ -353,6 +373,8 @@ static RPCHelpMan gobject_submit()
     const NodeContext& node = EnsureAnyNodeContext(request.context);
     const ChainstateManager& chainman = EnsureChainman(node);
 
+    EnsureCanSubmitProposals(node, "The parameters can be submitted unchanged from any node that can.");
+
     if(!node.mn_sync->IsBlockchainSynced()) {
         throw JSONRPCError(RPC_CLIENT_IN_INITIAL_DOWNLOAD, "Must wait for client to sync with masternode network. Try again in a minute or so.");
     }
diff --git a/test/functional/feature_governance.py b/test/functional/feature_governance.py
index 9b2a0847c61a..4f9d89f7f598 100755
--- a/test/functional/feature_governance.py
+++ b/test/functional/feature_governance.py
@@ -179,6 +179,10 @@ def run_test(self):
         assert_equal(len(self.nodes[0].gobject("list-prepared")), 3)
         assert_equal(len(self.nodes[0].gobject("list")), 0)
 
+        self.log.info("A proposal whose collateral burns for another proposal is rejected with the reason")
+        assert_raises_rpc_error(-32603, "Invalid proposal collateral: Couldn't find opReturn", pruned_node.gobject, "submit", "0", 1,
+                                proposal_time, p0_collateral_prepare["hex"], p1_collateral_prepare["collateralHash"])
+
         self.log.info("Submit objects")
         self.p0_hash = self.nodes[0].gobject("submit", "0", 1, proposal_time, p0_collateral_prepare["hex"], p0_collateral_prepare["collateralHash"])
         self.p1_hash = self.nodes[0].gobject("submit", "0", 1, proposal_time, p1_collateral_prepare["hex"], p1_collateral_prepare["collateralHash"])
@@ -523,6 +527,9 @@ def submit():
         shutil.rmtree(os.path.join(pruned_node.chain_path, "indexes", "govcollateralindex"))
         self.start_node(1)
         assert "govcollateralindex" not in pruned_node.getindexinfo()
+        assert_raises_rpc_error(-1, "Preparing a proposal now would burn its fee", pruned_node.gobject, "prepare",
+                                "0", 1, proposal["createdAt"], proposal["hex"])
+        assert_raises_rpc_error(-1, "Governance is disabled on this node", submit)
         self.stop_node(1, expected_stderr=EXPECTED_STDERR_GOV_PRUNED_TOO_FAR)
 
         self.log.info("A -reindex downloads the chain again, builds the index and turns governance back on")