diff --git a/doc/init.md b/doc/init.md
index da216e74adc4..87fa5cd81ee4 100644
--- a/doc/init.md
+++ b/doc/init.md
@@ -54,7 +54,8 @@ Paths
 All three configurations assume several paths that might need to be adjusted.
 
     Binary:              /usr/bin/dashd
-    Configuration file:  /etc/dashcore/dash.conf
+    Configuration file:  /etc/dash/dash.conf (systemd), /etc/dashcore/dash.conf (OpenRC and Upstart)
+                         or <datadir>/dash.conf (CentOS, whose init script passes no -conf)
     Data directory:      /var/lib/dashd
     PID file:            /var/run/dashd/dashd.pid (OpenRC and Upstart) or /run/dashd/dashd.pid (systemd)
     Lock file:           /var/lock/subsys/dashd (CentOS)
@@ -73,10 +74,10 @@ dashcore user and group to do so. This does not allow
 for the listing of files under the directory.
 
 NOTE: It is not currently possible to override `datadir` in
-`/etc/dash/dash.conf` with the current systemd, OpenRC, and Upstart init
+the configuration file with the current systemd, OpenRC, and Upstart init
 files out-of-the-box. This is because the command line options specified in the
 init files take precedence over the configurations in
-`/etc/dash/dash.conf`. However, some init systems have their own
+the configuration file. However, some init systems have their own
 configuration mechanisms that would allow for overriding the command line
 options specified in the init files (e.g. setting `BITCOIND_DATADIR` for
 OpenRC).
diff --git a/doc/man/dash-qt.1 b/doc/man/dash-qt.1
index ec4b1a40b8cf..b5d118c05a14 100644
--- a/doc/man/dash-qt.1
+++ b/doc/man/dash-qt.1
@@ -451,7 +451,7 @@ This will also rebuild active optional indexes.
 .IP
 Rebuild chain state from the currently indexed blocks. When in pruning
 mode or if blocks on disk might be corrupted, use full \fB\-reindex\fR
-instead. Deactivate all optional indexes before running this.
+instead.
 .HP
 \fB\-spentindex\fR
 .IP
diff --git a/doc/man/dashd.1 b/doc/man/dashd.1
index 5d4ae91221f1..32fd5dcb4238 100644
--- a/doc/man/dashd.1
+++ b/doc/man/dashd.1
@@ -449,7 +449,7 @@ This will also rebuild active optional indexes.
 .IP
 Rebuild chain state from the currently indexed blocks. When in pruning
 mode or if blocks on disk might be corrupted, use full \fB\-reindex\fR
-instead. Deactivate all optional indexes before running this.
+instead.
 .HP
 \fB\-spentindex\fR
 .IP
diff --git a/doc/release-notes.md b/doc/release-notes.md
index 791240fe14ae..69f8026a667e 100644
--- a/doc/release-notes.md
+++ b/doc/release-notes.md
@@ -24,7 +24,8 @@ On the first start after upgrading, a node that has `-addressindex`,
 database (see [Asynchronous address, spent and timestamp indexes](#asynchronous-address-spent-and-timestamp-indexes)).
 This can take 20-40 minutes or longer depending on hardware and index size.
 Start v24.0.0 for the first time with the same `-addressindex`, `-spentindex`
-and `-timestampindex` settings the node used before: an index that is left
+and `-timestampindex` settings the node used before (pruned nodes: see
+below): an index that is left
 disabled on any start of v24.0.0 can no longer reuse its old data, and is
 rebuilt from genesis when it is enabled again. The governance cache
 (`governance.dat`) and the spork cache (`sporks.dat`) changed format and are
@@ -32,8 +33,48 @@ discarded and re-synced from the network on the first start.
 
 A node that runs with `-txindex=0` must now also set `-disablegovernance`;
 otherwise it refuses to start (see [Updated settings](#updated-settings)).
-Pruned nodes are not affected, since `-prune` disables governance validation
-already.
+Pruned nodes are not affected by this, since `-prune` disables governance
+validation already.
+
+A pruned node (`-prune`) that also has `-addressindex` or `-spentindex` set
+refuses to start with an error, because these indexes now need the undo data
+that pruning deletes. v23 accepted that combination. Remove the index options
+from such a node before upgrading. Keeping them means running the node
+unpruned, which requires `-reindex` and downloading the whole chain again.
+`-timestampindex` can no longer be enabled on a datadir that has already been
+pruned (see
+[Asynchronous address, spent and timestamp indexes](#asynchronous-address-spent-and-timestamp-indexes)).
+
+Masternodes refuse to start with some settings that v23 accepted, such as
+`-blocksonly=1`, `-peerblockfilters=0` or a nonzero `-maxuploadtarget`. This
+applies from the first start of v24.0.0, not from hard fork activation. Check
+the masternode's configuration against
+[Masternode configuration requirements](#masternode-configuration-requirements)
+and remove such settings before upgrading. Masternodes must be upgraded and
+running before the `v24` start date (November 9, 2026 on mainnet): the
+activation signal needs 85% of the signing quorum's members to run v24, and a
+masternode that refuses to start cannot contribute to it (see
+[Network upgrade](#network-upgrade)).
+
+On mainnet, a masternode that moves to extended addresses must keep an IPv4
+address on the standard port as the first entry of each address list (see
+[Extended addresses](#extended-addresses)). (#8018)
+
+A node that ran a v24.0.0 release candidate with `-addressindex`,
+`-spentindex` or `-timestampindex` enabled should rebuild these indexes once
+after upgrading (see
+[Asynchronous address, spent and timestamp indexes](#asynchronous-address-spent-and-timestamp-indexes)),
+in one of two ways:
+
+- restart once with `-reindex`; or
+- start v24.0.0 once with `-addressindex=0 -spentindex=0 -timestampindex=0`,
+  stop it, delete the `indexes/addressindex`, `indexes/spentindex` and
+  `indexes/timestampindex` directories, then start it again with the indexes
+  enabled. They are rebuilt in the background.
+
+Do not only delete the index directories without the intermediate start: on a
+datadir a release candidate has used, that can leave empty indexes that report
+themselves as synced.
 
 Pruned nodes now keep at least 2304 blocks below the tip instead of 288 (see
 [Pruning](#pruning)). Blocks that an earlier version already pruned are not
@@ -44,20 +85,29 @@ recovered; a node that fails to validate a block after upgrading needs
 
 ### Downgrade to a version < v24.0.0
 
-Once the `v24` hard fork activates, versions older than v24.0.0 can no longer
-follow the network and must not be used.
+There is no supported downgrade after `v24` activation: v23 and older cannot
+follow the network once `v24` is active. They also cannot correctly read the
+masternode list data that v24.0.0 stores after activation, so do not start an
+older version on a datadir that v24.0.0 has used after activation.
 
-Before activation, downgrading to v23.x is possible with the following caveats:
+Before activation, downgrading to v23.1.x is possible with the following
+caveats:
 
 - The address, spent and timestamp indexes are moved out of the block index
   database into separate databases on the first start of v24.0.0. A node that
   had any of these indexes enabled must be restarted with `-reindex` after
-  downgrading.
+  downgrading. Older versions enforce this: they refuse to start with an index
+  that v24.0.0 has migrated until `-reindex` is given. (#8031)
 - The governance and spork caches written by v24.0.0 are not readable by older
   versions; they are discarded and re-synced from the network.
 - v24.0.0 does not upgrade the wallet file format. Wallet records added by
   v24.0.0 that older versions do not know about (such as the new CoinJoin
   pending-observation record) are ignored by them.
+- Dash-Qt moves the dust attack protection setting into the settings it shares
+  with `dashd` (see `-dustprotectionthreshold` under
+  [New options](#new-options)). Older versions don't read it there, so after a
+  downgrade dust protection is disabled and has to be enabled again in the
+  options dialog.
 
 ### Downgrade to a version < v23.0.0
 
@@ -67,8 +117,10 @@ require a reindex.
 ## Compatibility
 
 - Dash Core binaries now require macOS 14 (Sonoma) or later. Dash Core v23.1.x
-  binaries supported macOS 11 (Big Sur) or later. Windows 10 or later continues
-  to be required on Windows.
+  binaries supported macOS 11 (Big Sur) or later. Because v24.0.0 is mandatory,
+  users on macOS 13 or older must upgrade macOS, or move their node or wallet
+  to a supported system, before the `v24` hard fork activates. Windows 10 or
+  later continues to be required on Windows.
 - On Linux, kernel 3.17 or later is now required. The minimum glibc version
   (2.31) is unchanged.
 - `PROTOCOL_VERSION` has been bumped from `70240` to `70242` (see
@@ -203,6 +255,10 @@ Before activation there is no behavior change. (#7437, #7340)
   payment and every superblock payment must be paid by its own coinbase output,
   so two identical expected payments (same script and amount) require two
   outputs. Before activation one output could satisfy both. (#7362, #7377)
+  Mining pools should build exactly one coinbase output per `masternode[]` and
+  per `superblock[]` entry of `getblocktemplate`, in template order, even when
+  entries share a script or amount. After activation, a block that merges or
+  deduplicates them is invalid (`bad-cb-payee` / `bad-cb-amount`).
 
 ### EvoNode restrictions
 
@@ -240,7 +296,9 @@ Before activation there is no behavior change. (#7437, #7340)
   alongside the signatures, and repeats the zero-penalty warning for a
   registration. It refuses a registration or dissolution carrying an
   unsatisfied lock time or a relative input lock unless `allowTimeLocks` is
-  set.
+  set. It signs a dissolution only when it returns every share's principal to
+  its refund address, less the fee from the actor's share, as
+  `protx shared_dissolve_prepare` builds it.
 - `protx shared_combine` combines collected signatures and optionally submits.
   A dissolution combined here requires a signature from every share; unilateral
   dissolutions come fully signed from `protx shared_dissolve`. A
@@ -329,11 +387,32 @@ moves to extended addresses with a version 3 provider transaction (see
   transaction, but third-party tools that build version 2 EvoNode service
   updates must be updated.
 - Platform HTTPS entries on port 443 are accepted in extended addresses.
+- A version 3 (extended addresses) ProRegTx or ProUpServTx must list an IPv4
+  address as its first `coreP2PAddrs` entry, and an EvoNode's first
+  `platformP2PAddrs` and `platformHTTPSAddrs` entries must use that same IPv4
+  address. Further entries may use other addresses and network types (IPv6,
+  Tor, I2P, CJDNS, and domains for Platform HTTPS). Violations are rejected
+  with `bad-protx-netinfo-addr-type` or `bad-protx-netinfo-addr`. This applies
+  until masternodes are allowed to operate without IPv4, which is not scheduled
+  on mainnet. Testnet and devnets already allow it, so they are unaffected.
+  Regtest follows mainnet unless `-testactivationheight=ipv4_optional@<height>`
+  is set. (#8018)
+- On mainnet, the first entry of each address list must also use that list's
+  standard port: 9999 for `coreP2PAddrs`, 26656 for `platformP2PAddrs` and 443
+  for `platformHTTPSAddrs`, as legacy ProTx versions already require there.
+  Additional entries may use any otherwise valid port. Violations are rejected
+  with `bad-protx-netinfo-port`. (#8018)
 
 ## Version 2 Asset Unlock transactions
 
-Once the `v24` hard fork activates, Platform withdrawals are issued as version 2
-Asset Unlock transactions. Their transaction hash is computed with the quorum
+Once the `v24` hard fork activates, version 2 Asset Unlock transactions become
+valid. Version 1 Asset Unlock transactions remain valid after activation, and
+Platform withdrawals keep using version 1 until a future Dash Platform release
+starts issuing version 2. Until then, the version 2 features described below
+(the stable txid, InstantSend locking and relay by instance hash) do not apply
+to Platform withdrawals.
+
+The transaction hash of a version 2 Asset Unlock is computed with the quorum
 signing fields (`requestedHeight`, `quorumHash`, `quorumSig`) zeroed, so every
 instance Platform re-signs after an expiry is the same transaction with one
 stable txid. Spends of an unmined withdrawal's outputs therefore stay valid
@@ -363,6 +442,13 @@ longer penalized. (#7639, #7744)
 - `getassetunlockstatuses` reports `instantlock` for mempooled withdrawals.
 - `getrawtransaction` and `decoderawtransaction` report `instanceHash` for
   version 2 Asset Unlock transactions.
+- For pools, explorers and indexers: the txid of a version 2 Asset Unlock is
+  the double SHA-256 of the transaction with `requestedHeight`, `quorumHash`
+  and `quorumSig` zeroed, not of its serialized bytes. The full-bytes hash is
+  `instanceHash`. Block merkle roots and `getblocktemplate`
+  `transactions[].hash` use the txid, so software that hashes raw transaction
+  bytes (`getblocktemplate` `data`, ZMQ `rawtx`/`rawblock`, P2P) must use the
+  `hash` field or apply the same zeroing.
 
 ## Relative asset unlock limit
 
@@ -508,12 +594,18 @@ proofs. (#7107, #7727)
 
 ### Note for masternode operators running Dash Platform
 
-Current versions of Dash Platform read the `service` field and the
-`getblockchaininfo` `softforks` field from Dash Core. Operators running an
-EvoNode with Dash Platform (including setups managed with dashmate) must start
-Dash Core with both `-deprecatedrpc=service` and `-deprecatedrpc=softforks`
-until the Platform version they run no longer requires these fields. Removing
-either option before then can prevent Platform from operating correctly.
+Dash Platform reads the `service` field from Dash Core, and Platform versions
+before v5.0.0 also read the `getblockchaininfo` `softforks` field. EvoNode
+operators should upgrade Dash Platform to v5.0.0 or later together with Dash
+Core:
+
+- dashmate v5.0.0 and later start Dash Core with `-deprecatedrpc=service`, and
+  Platform v5.0.0 and later read deployment status from `getdeploymentinfo`, so
+  no extra configuration is needed.
+- Setups not managed by dashmate v5.0.0 or later must start Dash Core with
+  `-deprecatedrpc=service`, and Platform versions before v5.0.0 also need
+  `-deprecatedrpc=softforks`. Without these options Platform cannot operate
+  correctly.
 
 ## Descriptor wallets by default
 
@@ -526,6 +618,14 @@ used with descriptor wallets, so if your client code relies on these commands
 without specifying `descriptors=false` during wallet creation, you will need to
 update your code. (#7204)
 
+`createwallet` now also refuses `descriptors=false` without `load_on_startup`;
+since v21 this applied only to `descriptors=true`. To create a legacy wallet,
+pass both, for example:
+
+```
+dash-cli -named createwallet wallet_name=mywallet descriptors=false load_on_startup=true
+```
+
 `dash-wallet create` also creates a descriptor wallet by default. Pass the new
 `-legacy` option to create a legacy wallet instead. (#7204)
 
@@ -535,6 +635,18 @@ migration process is available in the
 [documentation](https://github.com/dashpay/dash/blob/master/doc/managing-wallets.md#migrating-legacy-wallets-to-descriptor-wallets).
 (#7275)
 
+Failure handling in `migratewallet`, `restorewallet` and
+`dash-wallet createfromdump` was fixed with backports from Bitcoin Core 28.x. A
+failed migration restores the original wallet and leaves the rest of the
+wallet directory as it was. After a migration, the migrated wallet and the
+watch-only and solvables wallets it created are reloaded from disk, and if one
+of them fails to load, the migration is rolled back. Migration backups are now
+named `<name>_<time>.legacy.bak` (`default_wallet_<time>.legacy.bak` for the
+unnamed wallet), and the unnamed wallet's watch-only and solvables wallets are
+named `default_wallet_watchonly` and `default_wallet_solvables`.
+`restorewallet` now accepts an existing empty directory and refuses only a
+directory that already contains a `wallet.dat`. (#8014)
+
 ## Asynchronous address, spent and timestamp indexes
 
 `TimestampIndex`, `SpentIndex`, and `AddressIndex` have been migrated from
@@ -569,9 +681,38 @@ Breaking changes:
   (`getaddressbalance`, `getaddressdeltas`, `getaddresstxids`,
   `getaddressutxos`, `getspentinfo` and `getblockhashes`) return an
   "… index is syncing" error instead of results. (#7101)
+- `-reindex-chainstate` can now be used with optional indexes enabled; they no
+  longer need to be turned off first. An index whose best block is no longer
+  in the block index (for example after `blocks/` and `chainstate/` were
+  deleted but `indexes/` was kept) is refused at startup with "best block of
+  the index not found"; delete that index's directory or use `-reindex`.
+  (bitcoin#25193)
+
+Release candidates rc.1 through rc.6 could leave these indexes inconsistent
+with the active chain after a reorg combined with an unclean shutdown or with
+an index being disabled for a while, and could report one of them as synced
+while it was empty after its directory was deleted on a datadir migrated from
+v23. v24.0.0 fixes both: indexes no longer commit their state ahead of the
+node's flushed chain state, and an empty or partially rebuilt index is rebuilt
+from genesis instead of being taken as migrated data. (#8031; #8042, merge
+9e5e3d59a1e, ported commit by commit)
+
+If an unclean shutdown loses blocks whose entries an index had already
+written, the node can now refuse to start with "<index>: the block the index
+was last synced to is not found. Please rebuild the index." In other cases, as
+in earlier versions, these indexes can keep entries of a block that was
+connected shortly before an unclean shutdown and then lost, if the network
+never sends that block again because a competing block won. In either case,
+rebuild them as described in [How to Upgrade](#how-to-upgrade). (#8042)
 
 ## Masternode configuration requirements
 
+The requirements below apply from the first start of v24.0.0, not from
+`v24` hard fork activation. Remove any conflicting settings from the
+masternode's configuration before upgrading, and upgrade before the `v24`
+start date (November 9, 2026 on mainnet), so that the masternode is running
+when the activation signal is signed.
+
 A masternode (`-masternodeblsprivkey`) now refuses to start unless:
 
 - `-blocksonly=0`
@@ -587,7 +728,12 @@ A masternode (`-masternodeblsprivkey`) now refuses to start unless:
 
 The relay policy checks do not apply on regtest. (#7754)
 
-In addition, DKG members now also vote a member bad if none of their masternode
+As before, a masternode turns on `-peerblockfilters` and
+`-blockfilterindex=basic` unless they are set explicitly, so
+`-blockfilterindex=0` also stops it from starting, as it already did in v23.
+
+In addition, DKG members running v24.0.0 now also vote a member bad (which
+leads to PoSe penalties once enough members agree) if none of their masternode
 connections to it advertise:
 
 - transaction relay (`relay=1` in the `version` message);
@@ -766,7 +912,10 @@ and RPC parameters.
   arguments of `protx diff` and `protx listdiff`, which take a block hash or a
   height and therefore still accept a height as a string. There is no runtime
   option to restore the old behaviour; `-deprecatedrpc=permissive_bool` only
-  applies to booleans. (#7099)
+  applies to booleans. (#7099) Client libraries that coerce arguments to
+  strings fail with error -3 or -8, for example on the `protx register*`
+  `collateralIndex`, `masternode winners <count>`, `quorum memberof … <n>` and
+  `protx list registered true`.
 - Previously the `setban`, `addpeeraddress` and `walletcreatefundedpsbt` methods
   allowed non-boolean and non-null values to be passed as boolean parameters.
   Any string, number, array, or object value that was passed would be treated
@@ -915,6 +1064,9 @@ and RPC parameters.
 - Fee estimates are now saved hourly, and `fee_estimates.dat` is ignored at
   startup if it is more than 60 hours old, so a node that was offline for longer
   than that rebuilds its estimates. (#7711)
+- `dashd` no longer creates an empty `dash.conf` when none exists, matching
+  Bitcoin Core. `dash-qt`'s "Open Configuration File" still creates it on
+  demand. (#8029)
 
 ## Pruning
 
@@ -1067,6 +1219,16 @@ and RPC parameters.
   removed from these RPCs in v25. It can be temporarily re-enabled during the
   deprecation period by launching dashd with the configuration option
   `-deprecatedrpc=walletwarningfield`. (#7711)
+- Some wallet RPC error messages changed with upstream backports, which
+  matters for software that matches on them:
+  - `send` and `walletcreatefundedpsbt` with preselected inputs that don't
+    cover the target return "The preselected coins total amount does not cover
+    the transaction target…" instead of "Insufficient funds".
+  - `importpubkey` quotes the rejected value, for example
+    `Pubkey "<value>" must be a hex string`.
+  - The `protx` error for a `platformP2PAddrs` value that a version 2 ProTx
+    can't carry now reads "…this ProTx version only accepts a bare port
+    number…".
 
 ## GUI changes
 
diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index 90a0ed75ed64..b43918ed708b 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -82,6 +82,7 @@ BITCOIN_TESTS =\
   test/base32_tests.cpp \
   test/base58_tests.cpp \
   test/base64_tests.cpp \
+  test/baseindex_tests.cpp \
   test/bech32_tests.cpp \
   test/bip32_tests.cpp \
   test/bip324_tests.cpp \
@@ -138,6 +139,7 @@ BITCOIN_TESTS =\
   test/hash_tests.cpp \
   test/httpserver_tests.cpp \
   test/i2p_tests.cpp \
+  test/index_migration_tests.cpp \
   test/interfaces_tests.cpp \
   test/key_io_tests.cpp \
   test/key_tests.cpp \
diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index 90199206da92..c8014cb6f278 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -194,6 +194,7 @@ class CMainParams : public CChainParams {
         consensus.V20Height = 1987776; // 000000000000001bf41cff06b76780050682ca29e61a91c391893d4745579777
         consensus.MN_RRHeight = 2128896; // 0000000000000009a9696da93d3807eb14eb00a4ff449206d689156a21b27f26
         consensus.WithdrawalsHeight = 2201472; // 00000000000000210518749e17c00b035a2a4982c906236c28c41ea2231bf7ef
+        consensus.IPv4OptionalHeight = std::numeric_limits<int>::max(); // Not scheduled
         consensus.MinBIP9WarningHeight = 2201472 + 2016; // withdrawals activation height + miner confirmation window
         consensus.powLimit = uint256S("00000fffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"); // ~uint256(0) >> 20
         consensus.nPowTargetTimespan = 24 * 60 * 60; // Dash: 1 day
@@ -405,6 +406,7 @@ class CTestNetParams : public CChainParams {
         consensus.V20Height = 905100; // 0000020c5e0f86f385cbf8e90210de9a9fd63633f01433bf47a6b3227a2851fd
         consensus.MN_RRHeight = 1066900; // 000000d05d445958a9a4ad6bdc0f4bfb25af124b2326060703373ff2d3b397e9
         consensus.WithdrawalsHeight = 1148500; // 000000212a6fec2ee2af040c6d7a176360b154cbaa998888170cfd9ae7dd632d
+        consensus.IPv4OptionalHeight = 0; // Version 3 ProTxs without IPv4 primary addresses are already mined
         consensus.MinBIP9WarningHeight = 1148500 + 2016;  // withdrawals activation height + miner confirmation window
         consensus.powLimit = uint256S("00000fffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"); // ~uint256(0) >> 20
         consensus.nPowTargetTimespan = 24 * 60 * 60; // Dash: 1 day
@@ -589,6 +591,7 @@ class CDevNetParams : public CChainParams {
         consensus.V20Height = 2;     // V20 activated immediately on devnet
         consensus.MN_RRHeight = 2;   // MN_RR activated immediately on devnet
         consensus.WithdrawalsHeight = 2;   // withdrawals activated immediately on devnet
+        consensus.IPv4OptionalHeight = 0;  // same as testnet
         consensus.MinBIP9WarningHeight = 2 + 2016; // withdrawals activation height + miner confirmation window
         consensus.powLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"); // ~uint256(0) >> 1
         consensus.nPowTargetTimespan = 24 * 60 * 60; // Dash: 1 day
@@ -833,6 +836,7 @@ class CRegTestParams : public CChainParams {
         consensus.V20Height = consensus.DIP0003Height; // Active not earlier than dip0003. Functional tests (DashTestFramework) uses height 100 (same as coinbase maturity)
         consensus.MN_RRHeight = consensus.V20Height; // MN_RR does not really have effect before v20 activation
         consensus.WithdrawalsHeight = 600;
+        consensus.IPv4OptionalHeight = std::numeric_limits<int>::max(); // see -testactivationheight
         consensus.MinBIP9WarningHeight = 0;
         consensus.powLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"); // ~uint256(0) >> 1
         consensus.nPowTargetTimespan = 24 * 60 * 60; // Dash: 1 day
@@ -1082,6 +1086,8 @@ static void MaybeUpdateHeights(const ArgsManager& args, Consensus::Params& conse
             consensus.V20Height = int{height};
         } else if (name == "mn_rr") {
             consensus.MN_RRHeight = int{height};
+        } else if (name == "ipv4_optional") {
+            consensus.IPv4OptionalHeight = int{height};
         } else {
             throw std::runtime_error(strprintf("Invalid name (%s) for -testactivationheight=name@height.", arg));
         }
@@ -1444,7 +1450,7 @@ void SetupChainParamsOptions(ArgsManager& argsman)
     argsman.AddArg("-llmqtestplatformparams=<size>:<threshold>", "Override the default LLMQ size for the LLMQ_TEST_PLATFORM quorum (default: 3:2, regtest-only)", ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::CHAINPARAMS);
     argsman.AddArg("-minimumdifficultyblocks=<n>", "The number of blocks that can be mined with the minimum difficulty at the start of a chain (default: 0, devnet-only)", ArgsManager::ALLOW_ANY, OptionsCategory::CHAINPARAMS);
     argsman.AddArg("-powtargetspacing=<n>", "Override the default PowTargetSpacing value in seconds (default: 2.5 minutes, devnet-only)", ArgsManager::ALLOW_ANY | ArgsManager::DISALLOW_NEGATION, OptionsCategory::CHAINPARAMS);
-    argsman.AddArg("-testactivationheight=name@height.", "Set the activation height of 'name' (bip147, bip34, dersig, cltv, csv, brr, dip0001, dip0008, dip0024, v19, v20, mn_rr). (regtest-only)", ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::CHAINPARAMS);
+    argsman.AddArg("-testactivationheight=name@height.", "Set the activation height of 'name' (bip147, bip34, dersig, cltv, csv, brr, dip0001, dip0008, dip0024, v19, v20, mn_rr, ipv4_optional). (regtest-only)", ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::CHAINPARAMS);
     argsman.AddArg("-vbparams=<deployment>:<start>:<end>(:min_activation_height(:<window>:<threshold/thresholdstart>(:<thresholdmin>:<falloffcoeff>:<mnactivation>)))",
                  "Use given start/end times and min_activation_height for specified version bits deployment (regtest-only). "
                  "Specifying window, threshold/thresholdstart, thresholdmin, falloffcoeff and mnactivation is optional.", ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::CHAINPARAMS);
diff --git a/src/consensus/params.h b/src/consensus/params.h
index 7a6f724b8e48..59384abc67da 100644
--- a/src/consensus/params.h
+++ b/src/consensus/params.h
@@ -36,8 +36,9 @@ enum BuriedDeployment : int16_t {
     DEPLOYMENT_V20,
     DEPLOYMENT_MN_RR,
     DEPLOYMENT_WITHDRAWALS,
+    DEPLOYMENT_IPV4_OPTIONAL, // Masternodes may operate without IPv4
 };
-constexpr bool ValidDeployment(BuriedDeployment dep) { return dep <= DEPLOYMENT_WITHDRAWALS; }
+constexpr bool ValidDeployment(BuriedDeployment dep) { return dep <= DEPLOYMENT_IPV4_OPTIONAL; }
 
 enum DeploymentPos : uint16_t {
     DEPLOYMENT_TESTDUMMY,
@@ -151,6 +152,12 @@ struct Params {
     int MN_RRHeight;
     /** Block height at which WITHDRAWALS (Deployment of quorum fix and higher limits for withdrawals) becomes active */
     int WithdrawalsHeight;
+    /** Block height from which a masternode's primary addresses no longer need to be IPv4.
+     *  std::numeric_limits<int>::max() while no activation is scheduled. A placeholder: a version bits (EHF)
+     *  deployment replacing it must stay always active on testnet and devnets. The mainnet primary port pins
+     *  don't depend on it, so a first entry that can't use the standard port (such as I2P, which uses port 0)
+     *  stays invalid there. */
+    int IPv4OptionalHeight;
     /** Don't warn about unknown BIP 9 activations below this height.
      * This prevents us from warning about the CSV and DIP activations. */
     int MinBIP9WarningHeight;
@@ -232,6 +239,8 @@ struct Params {
             return MN_RRHeight;
         case DEPLOYMENT_WITHDRAWALS:
             return WithdrawalsHeight;
+        case DEPLOYMENT_IPV4_OPTIONAL:
+            return IPv4OptionalHeight;
         } // no default case, so the compiler can warn about missing cases
         return std::numeric_limits<int>::max();
     }
diff --git a/src/deploymentinfo.cpp b/src/deploymentinfo.cpp
index 594bf6615a08..973a46c02e6a 100644
--- a/src/deploymentinfo.cpp
+++ b/src/deploymentinfo.cpp
@@ -55,6 +55,8 @@ std::string DeploymentName(Consensus::BuriedDeployment dep)
         return "mn_rr";
     case Consensus::DEPLOYMENT_WITHDRAWALS:
         return "withdrawals";
+    case Consensus::DEPLOYMENT_IPV4_OPTIONAL:
+        return "ipv4_optional";
     } // no default case, so the compiler can warn about missing cases
     return "";
 }
diff --git a/src/evo/core_write.cpp b/src/evo/core_write.cpp
index 2a645501acf2..a5cbe174aee8 100644
--- a/src/evo/core_write.cpp
+++ b/src/evo/core_write.cpp
@@ -60,13 +60,9 @@ template UniValue GetNetInfoWithLegacyFields(const CDeterministicMNState& obj, c
 template <bool is_p2p, typename Obj>
 int32_t GetPlatformPort(const Obj& obj)
 {
-    // Currently, there is nothing that prevents PLATFORM_{HTTPS,P2P} to be registered to
-    // an addr *different* from the primary addr for CORE_P2P. This breaks the assumptions
-    // under which platform{HTTP,P2P}Port operate under (i.e. all three are hosted with the
-    // same addr).
-    //
-    // TODO: Introduce restrictions that enforce this assumption *until* we remove legacy
-    //       fields for good.
+    // Until DEPLOYMENT_IPV4_OPTIONAL is active, consensus requires the first PLATFORM_{HTTPS,P2P} entries to
+    // use the primary addr for CORE_P2P, as platform{HTTP,P2P}Port assume (i.e. all three are hosted with the
+    // same addr). Once it is (always on testnet and devnets), the ports reported here may belong to another addr.
     //
     bool is_legacy{!(CHECK_NONFATAL(obj.netInfo)->CanStorePlatform())};
     if constexpr (is_p2p) {
diff --git a/src/evo/netinfo.cpp b/src/evo/netinfo.cpp
index b5c806706d92..029c60e8a2a7 100644
--- a/src/evo/netinfo.cpp
+++ b/src/evo/netinfo.cpp
@@ -64,6 +64,27 @@ bool IsAllowedPlatformHTTPPort(uint16_t port)
     }
     return false;
 }
+
+uint16_t GetPrimaryAddrPort(NetInfoPurpose purpose)
+{
+    switch (purpose) {
+    case NetInfoPurpose::CORE_P2P:
+        return MainParams().GetDefaultPort();
+    case NetInfoPurpose::PLATFORM_P2P:
+        return MainParams().GetDefaultPlatformP2PPort();
+    case NetInfoPurpose::PLATFORM_HTTPS:
+        return MainParams().GetDefaultPlatformHTTPPort();
+    } // no default case, so the compiler can warn about missing cases
+    Assume(false);
+    return 0;
+}
+
+//! On mainnet, the first entry of a purpose must use that purpose's standard port
+NetInfoStatus ValidateMainnetPrimaryPort(NetInfoPurpose purpose, const NetInfoEntry& primary)
+{
+    if (!IsNodeOnMainnet() || primary.GetPort() == GetPrimaryAddrPort(purpose)) return NetInfoStatus::Success;
+    return NetInfoStatus::BadPort;
+}
 } // anonymous namespace
 
 bool IsNodeOnMainnet() { return Params().NetworkIDString() == CBaseChainParams::MAIN; }
@@ -427,6 +448,11 @@ NetInfoStatus ExtNetInfo::ProcessCandidate(const NetInfoPurpose purpose, const N
         // Domains only allowed for Platform HTTPS API
         return NetInfoStatus::BadInput;
     }
+    if (!HasEntries(purpose)) {
+        if (const auto ret{ValidateMainnetPrimaryPort(purpose, candidate)}; ret != NetInfoStatus::Success) {
+            return ret;
+        }
+    }
     if (auto it{m_data.find(purpose)}; it != m_data.end()) {
         // Existing entries list found, check limit
         auto& [_, entries] = *it;
@@ -619,6 +645,11 @@ NetInfoStatus ExtNetInfo::Validate() const
             }
         }
     }
+    for (const auto& [purpose, entries] : m_data) {
+        if (const auto ret{ValidateMainnetPrimaryPort(purpose, entries.front())}; ret != NetInfoStatus::Success) {
+            return ret;
+        }
+    }
     return NetInfoStatus::Success;
 }
 
diff --git a/src/evo/providertx.cpp b/src/evo/providertx.cpp
index f20a981ca3ff..36385f051c1a 100644
--- a/src/evo/providertx.cpp
+++ b/src/evo/providertx.cpp
@@ -229,9 +229,35 @@ static bool CheckNetInfo(const NetInfoInterface& net_info, TxValidationState& st
     assert(false);
 }
 
+//! The primary Core P2P address must be IPv4, and Platform's primary addresses must be on that same address
+static bool CheckIPv4Primaries(const NetInfoInterface& net_info, TxValidationState& state)
+{
+    const CService core_primary{net_info.GetPrimary()};
+    if (!core_primary.IsIPv4()) {
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-addr-type",
+                             strprintf("first %s entry must be IPv4", PurposeToString(NetInfoPurpose::CORE_P2P)));
+    }
+    for (const auto purpose : {NetInfoPurpose::PLATFORM_P2P, NetInfoPurpose::PLATFORM_HTTPS}) {
+        const auto entries{net_info.GetEntries(purpose)};
+        if (entries.empty()) continue;
+        const auto service_opt{entries.front().GetAddrPort()};
+        if (!service_opt || !service_opt->IsIPv4()) {
+            return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-addr-type",
+                                 strprintf("first %s entry must be IPv4", PurposeToString(purpose)));
+        }
+        if (CNetAddr{*service_opt} != CNetAddr{core_primary}) {
+            return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-addr",
+                                 strprintf("first %s entry must use the first %s address", PurposeToString(purpose),
+                                           PurposeToString(NetInfoPurpose::CORE_P2P)));
+        }
+    }
+    return true;
+}
+
 bool CheckProviderNetworkFields(const std::shared_ptr<NetInfoInterface>& net_info, MnType type, uint16_t version,
                                 const uint160* platform_node_id, uint16_t platform_p2p_port,
-                                uint16_t platform_http_port, bool allow_empty, TxValidationState& state)
+                                uint16_t platform_http_port, bool allow_empty, bool ipv4_optional,
+                                TxValidationState& state)
 {
     if (!net_info || net_info->CanStorePlatform() != (version >= ProTxVersion::ExtAddr)) {
         return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-protx-netinfo-version");
@@ -244,6 +270,10 @@ bool CheckProviderNetworkFields(const std::shared_ptr<NetInfoInterface>& net_inf
         if (!IsNetInfoTriviallyValid(net_info, type, state) || !CheckNetInfo(*net_info, state)) {
             return false;
         }
+        // Checked here rather than in Validate(), which also checks stored masternode states without a height
+        if (!ipv4_optional && !CheckIPv4Primaries(*net_info, state)) {
+            return false;
+        }
     }
 
     if (type != MnType::Evo) return true;
diff --git a/src/evo/providertx.h b/src/evo/providertx.h
index 943805567374..aa1c1f907a3a 100644
--- a/src/evo/providertx.h
+++ b/src/evo/providertx.h
@@ -105,10 +105,12 @@ template<class T>
 [[nodiscard]] UniValue PayoutListToJson(const MasternodePayoutShares& payouts);
 
 /** Validate all provider network fields using the same rules as special transaction validation.
- *  Pass nullptr for platform_node_id when validating endpoint input separately from the rest of a payload. */
+ *  Pass nullptr for platform_node_id when validating endpoint input separately from the rest of a payload.
+ *  ipv4_optional is SpecialTxRules::ipv4_optional for the block the transaction would be included in. */
 [[nodiscard]] bool CheckProviderNetworkFields(const std::shared_ptr<NetInfoInterface>& net_info, MnType type,
                                               uint16_t version, const uint160* platform_node_id, uint16_t platform_p2p_port,
-                                              uint16_t platform_http_port, bool allow_empty, TxValidationState& state);
+                                              uint16_t platform_http_port, bool allow_empty, bool ipv4_optional,
+                                              TxValidationState& state);
 
 /** The count, per-share bound and sum rules of IsShareListTriviallyValid, usable before any share address exists */
 [[nodiscard]] bool AreShareAmountsValid(const std::vector<CAmount>& amounts, CAmount required_collateral,
diff --git a/src/evo/providertx_service.cpp b/src/evo/providertx_service.cpp
index 5732a5162554..6fa53be1ad44 100644
--- a/src/evo/providertx_service.cpp
+++ b/src/evo/providertx_service.cpp
@@ -109,6 +109,14 @@ bool EvoSharesActive(node::NodeContext& node)
     return DeploymentActiveAfter(chainman.ActiveChain().Tip(), chainman, Consensus::DEPLOYMENT_EVO_SHARES);
 }
 
+bool IPv4OptionalActive(node::NodeContext& node)
+{
+    AssertLockNotHeld(::cs_main);
+    auto& chainman{*Assert(node.chainman)};
+    LOCK(::cs_main);
+    return DeploymentActiveAfter(chainman.ActiveChain().Tip(), chainman, Consensus::DEPLOYMENT_IPV4_OPTIONAL);
+}
+
 struct ChainSnapshot {
     uint16_t provider_tx_version{0};
     CDeterministicMNCPtr dmn;
@@ -253,13 +261,15 @@ std::optional<ProviderTxError> ApplyNetInfo(ProTx& payload, const ProviderNetInf
 }
 
 template <typename ProTx>
-std::optional<ProviderTxError> ValidateNetworkFields(const ProTx& payload, bool allow_empty, bool check_platform_node_id)
+std::optional<ProviderTxError> ValidateNetworkFields(const ProTx& payload, bool allow_empty,
+                                                    bool check_platform_node_id, bool ipv4_optional)
 {
     TxValidationState state;
     const uint160* platform_node_id{check_platform_node_id && payload.nType == MnType::Evo ? &payload.platformNodeID
                                                                                            : nullptr};
     if (!CheckProviderNetworkFields(payload.netInfo, payload.nType, payload.nVersion, platform_node_id,
-                                    payload.platformP2PPort, payload.platformHTTPPort, allow_empty, state)) {
+                                    payload.platformP2PPort, payload.platformHTTPPort, allow_empty, ipv4_optional,
+                                    state)) {
         return Error(ProviderTxErrorCode::CONSENSUS_REJECTED, state.ToString(), state.GetRejectReason());
     }
     return std::nullopt;
@@ -536,8 +546,8 @@ RegistrationResult BuildRegistration(node::NodeContext& node, Wallet& wallet,
     }
 
     if (auto error{ApplyPlatformNodeId(payload, request.platform_node_id)}) return *error;
-    if (auto error{ValidateNetworkFields(payload, /*allow_empty=*/true,
-                                         /*check_platform_node_id=*/true)}) {
+    if (auto error{ValidateNetworkFields(payload, /*allow_empty=*/true, /*check_platform_node_id=*/true,
+                                         IPv4OptionalActive(node))}) {
         return *error;
     }
 
@@ -682,6 +692,24 @@ std::variant<Dissolution, ProviderTxError> BuildDissolution(const CDeterministic
     return ret;
 }
 
+//! True when `tx` pays what BuildDissolution() builds without a penalty: every share's principal
+//! back to its refund script, less a fee from the actor's share. Consensus also accepts other
+//! payouts every share owner signs, but no RPC or GUI flow builds one, so none is signed here.
+bool ReturnsPrincipal(const CDeterministicMN& dmn, uint16_t actor_index, const CTransaction& tx)
+{
+    CAmount fee{0};
+    for (const auto& share : dmn.pdmnState->shares) fee += share.amount;
+    CAmount out_total{0};
+    for (const auto& out : tx.vout) {
+        if (!MoneyRange(out.nValue) || !MoneyRange(out_total + out.nValue)) return false;
+        out_total += out.nValue;
+    }
+    fee -= out_total;
+    const auto built{BuildDissolution(dmn, actor_index, /*penalty=*/0, fee)};
+    const auto* expected{std::get_if<Dissolution>(&built)};
+    return expected && tx.vout == expected->tx.vout;
+}
+
 //! True when `tx` carries an absolute lock not yet satisfied at the next block, or any BIP68
 //! relative lock (special transactions are version 3, so sequences carry relative-lock
 //! semantics). Wallet-funded inputs use a non-final sequence purely for fee sniping
@@ -797,11 +825,20 @@ std::optional<ProviderTxError> CheckRegistrarUpdateFunding(Wallet& wallet, const
 
 interfaces::ProviderTxCapabilities GetCapabilities(node::NodeContext& node, std::optional<bool> basic_override)
 {
-    const uint16_t version{CurrentProviderTxVersion(node, basic_override)};
-    return interfaces::ProviderTxCapabilities{version, version >= ProTxVersion::ExtAddr};
+    AssertLockNotHeld(::cs_main);
+    auto& chainman{*Assert(node.chainman)};
+    LOCK(::cs_main);
+    const CBlockIndex* tip{chainman.ActiveChain().Tip()};
+    const uint16_t version{DeploymentToProtxVersion(tip, chainman, basic_override)};
+    return interfaces::ProviderTxCapabilities{
+        .version = version,
+        .extended_addresses = version >= ProTxVersion::ExtAddr,
+        .ipv4_optional = DeploymentActiveAfter(tip, chainman, Consensus::DEPLOYMENT_IPV4_OPTIONAL),
+    };
 }
 
-std::optional<ProviderTxError> ValidateNetInfo(const ProviderNetInfo& net_info, MnType type, uint16_t version, bool optional)
+std::optional<ProviderTxError> ValidateNetInfo(const ProviderNetInfo& net_info, MnType type, uint16_t version,
+                                               bool ipv4_optional, bool optional)
 {
     if (!IsValidMnType(type)) {
         return Error(ProviderTxErrorCode::INVALID_PARAMETER, "invalid masternode type");
@@ -815,7 +852,30 @@ std::optional<ProviderTxError> ValidateNetInfo(const ProviderNetInfo& net_info,
     payload.nVersion = version;
     payload.netInfo = NetInfoInterface::MakeNetInfo(version);
     if (auto error{ApplyNetInfo(payload, net_info, type == MnType::Evo, optional)}) return error;
-    return ValidateNetworkFields(payload, optional, /*check_platform_node_id=*/false);
+    return ValidateNetworkFields(payload, optional, /*check_platform_node_id=*/false, ipv4_optional);
+}
+
+std::optional<std::string> FindNetInfoInUse(node::NodeContext& node, const ProviderNetInfo& net_info, MnType type,
+                                            uint16_t version, bool ipv4_optional)
+{
+    if (ValidateNetInfo(net_info, type, version, ipv4_optional, /*optional=*/true) || !node.dmnman) {
+        return std::nullopt;
+    }
+    CProRegTx payload;
+    payload.nType = type;
+    payload.nVersion = version;
+    payload.netInfo = NetInfoInterface::MakeNetInfo(version);
+    if (ApplyNetInfo(payload, net_info, type == MnType::Evo, /*optional=*/true)) return std::nullopt;
+
+    const auto mn_list{node.dmnman->GetListAtChainTip()};
+    for (const auto& entry : payload.netInfo->GetEntries()) {
+        const auto service{entry.GetAddrPort()};
+        const auto domain{entry.GetDomainPort()};
+        if ((service && mn_list.HasUniqueProperty(*service)) || (domain && mn_list.HasUniqueProperty(*domain))) {
+            return entry.ToStringAddrPort();
+        }
+    }
+    return std::nullopt;
 }
 
 ProviderTxResult<ProviderTxSubmission> Register(node::NodeContext& node, Wallet& wallet,
@@ -901,8 +961,8 @@ ProviderTxResult<ProviderTxSubmission> UpdateService(node::NodeContext& node, Wa
         return *error;
     }
     if (auto error{ApplyPlatformNodeId(payload, request.platform_node_id)}) return *error;
-    if (auto error{ValidateNetworkFields(payload, /*allow_empty=*/false,
-                                         /*check_platform_node_id=*/true)}) {
+    if (auto error{ValidateNetworkFields(payload, /*allow_empty=*/false, /*check_platform_node_id=*/true,
+                                         IPv4OptionalActive(node))}) {
         return *error;
     }
     payload.scriptOperatorPayout = request.operator_payout ? GetScriptForDestination(*request.operator_payout)
@@ -1108,7 +1168,8 @@ ProviderTxResult<PreparedSharedRegistration> PrepareSharedRegistration(node::Nod
         return *error;
     }
     if (auto error{ApplyPlatformNodeId(payload, request.platform_node_id)}) return *error;
-    if (auto error{ValidateNetworkFields(payload, /*allow_empty=*/true, /*check_platform_node_id=*/true)}) {
+    if (auto error{ValidateNetworkFields(payload, /*allow_empty=*/true, /*check_platform_node_id=*/true,
+                                         IPv4OptionalActive(node))}) {
         return *error;
     }
 
@@ -1203,6 +1264,13 @@ ProviderTxResult<SharedSignResult> SignShared(node::NodeContext& node, Wallet& w
         }
         const auto dmn{GetSharedMn(node, payload->proTxHash)};
         if (!dmn) return SharedMnNotFound();
+        if (!ReturnsPrincipal(*dmn, payload->actorIndex, tx)) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                         strprintf("dissolution does not return every share's principal to its refund address, "
+                                   "less a fee of at most %d duffs from the actor's share; only dissolutions as "
+                                   "built by \"protx shared_dissolve_prepare\" are signed",
+                                   CProDisTx::MAX_FEE));
+        }
         if (auto error{check_time_lock("dissolution")}) return *error;
         shares = dmn->pdmnState->shares;
         sign_hash = payload->MakeSignHash(tx, static_cast<uint8_t>(shares.size()));
diff --git a/src/evo/providertx_service.h b/src/evo/providertx_service.h
index b14bf4e636c5..1a7534b48d9c 100644
--- a/src/evo/providertx_service.h
+++ b/src/evo/providertx_service.h
@@ -8,6 +8,7 @@
 #include <interfaces/providertx.h>
 
 #include <optional>
+#include <string>
 
 namespace interfaces {
 class Wallet;
@@ -23,7 +24,10 @@ interfaces::ProviderTxCapabilities GetCapabilities(node::NodeContext& node,
                                                    std::optional<bool> basic_override = std::nullopt);
 
 std::optional<interfaces::ProviderTxError> ValidateNetInfo(const interfaces::ProviderNetInfo& net_info, MnType type,
-                                                           uint16_t version, bool optional);
+                                                           uint16_t version, bool ipv4_optional, bool optional);
+
+std::optional<std::string> FindNetInfoInUse(node::NodeContext& node, const interfaces::ProviderNetInfo& net_info,
+                                            MnType type, uint16_t version, bool ipv4_optional);
 
 interfaces::ProviderTxResult<interfaces::ProviderTxSubmission> Register(
     node::NodeContext& node, interfaces::Wallet& wallet, const interfaces::ProviderRegistrationRequest& request);
diff --git a/src/evo/specialtxman.cpp b/src/evo/specialtxman.cpp
index b1576f527508..8cbceb5d6180 100644
--- a/src/evo/specialtxman.cpp
+++ b/src/evo/specialtxman.cpp
@@ -233,7 +233,7 @@ bool CSpecialTxProcessor::CheckSpecialTxInner(const CChain* chain, const CTransa
         case TRANSACTION_PROVIDER_REGISTER:
             return CheckProRegTx(tx, pindexPrev, m_dmnman, view, m_consensus_params, rules, state, check_sigs);
         case TRANSACTION_PROVIDER_UPDATE_SERVICE:
-            return CheckProUpServTx(tx, pindexPrev, m_dmnman, m_consensus_params, rules.v24, state, check_sigs);
+            return CheckProUpServTx(tx, pindexPrev, m_dmnman, m_consensus_params, rules, state, check_sigs);
         case TRANSACTION_PROVIDER_UPDATE_REGISTRAR:
             return CheckProUpRegTx(tx, pindexPrev, m_dmnman, view, m_consensus_params, rules, state, check_sigs);
         case TRANSACTION_PROVIDER_UPDATE_REVOKE:
@@ -1232,7 +1232,8 @@ bool CheckProRegTx(const CTransaction& tx, gsl::not_null<const CBlockIndex*> pin
     // It's allowed to set addr to 0, which will put the MN into PoSe-banned state and require a ProUpServTx to be
     // issues later. If any of both is set, it must be valid however
     if (!CheckProviderNetworkFields(opt_ptx->netInfo, opt_ptx->nType, opt_ptx->nVersion, &opt_ptx->platformNodeID,
-                                    opt_ptx->platformP2PPort, opt_ptx->platformHTTPPort, /*allow_empty=*/true, state)) {
+                                    opt_ptx->platformP2PPort, opt_ptx->platformHTTPPort, /*allow_empty=*/true,
+                                    rules.ipv4_optional, state)) {
         return false;
     }
 
@@ -1381,17 +1382,18 @@ bool CheckProRegTx(const CTransaction& tx, gsl::not_null<const CBlockIndex*> pin
 }
 
 bool CheckProUpServTx(const CTransaction& tx, gsl::not_null<const CBlockIndex*> pindexPrev,
-                      CDeterministicMNManager& dmnman, const Consensus::Params& consensus_params, bool is_v24_active,
+                      CDeterministicMNManager& dmnman, const Consensus::Params& consensus_params, SpecialTxRules rules,
                       TxValidationState& state, bool check_sigs)
 {
-    const auto opt_ptx = GetValidatedPayload<CProUpServTx>(tx, pindexPrev, consensus_params, is_v24_active, state);
+    const auto opt_ptx = GetValidatedPayload<CProUpServTx>(tx, pindexPrev, consensus_params, rules.v24, state);
     if (!opt_ptx) {
         // pass the state returned by the function above
         return false;
     }
 
     if (!CheckProviderNetworkFields(opt_ptx->netInfo, opt_ptx->nType, opt_ptx->nVersion, &opt_ptx->platformNodeID,
-                                    opt_ptx->platformP2PPort, opt_ptx->platformHTTPPort, /*allow_empty=*/false, state)) {
+                                    opt_ptx->platformP2PPort, opt_ptx->platformHTTPPort, /*allow_empty=*/false,
+                                    rules.ipv4_optional, state)) {
         return false;
     }
 
@@ -1409,21 +1411,21 @@ bool CheckProUpServTx(const CTransaction& tx, gsl::not_null<const CBlockIndex*>
         return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-protx-type-mismatch");
     }
 
-    if (!IsVersionChangeValid(dmn->pdmnState->nVersion, opt_ptx->nVersion, is_v24_active, state)) {
+    if (!IsVersionChangeValid(dmn->pdmnState->nVersion, opt_ptx->nVersion, rules.v24, state)) {
         // pass the state returned by the function above
         return false;
     }
 
     // From ExtAddr on the Platform ports live in netInfo and are never derived from the scalar fields,
     // so an EvoNode service update has to spell them out
-    if (is_v24_active && opt_ptx->nType == MnType::Evo && opt_ptx->nVersion < ProTxVersion::ExtAddr) {
+    if (rules.v24 && opt_ptx->nType == MnType::Evo && opt_ptx->nVersion < ProTxVersion::ExtAddr) {
         return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-protx-version-disallowed");
     }
 
-    if (is_v24_active) {
+    if (rules.v24) {
         CDeterministicMNState new_state{*dmn->pdmnState};
         BlockValidationState migration_state;
-        if (!ApplyProUpServTx(new_state, *opt_ptx, is_v24_active, migration_state)) {
+        if (!ApplyProUpServTx(new_state, *opt_ptx, rules.v24, migration_state)) {
             return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, migration_state.GetRejectReason());
         }
     }
@@ -1432,7 +1434,7 @@ bool CheckProUpServTx(const CTransaction& tx, gsl::not_null<const CBlockIndex*>
     // re-encodes its stored key, moving it to the basic-scheme unique-property slot. If another
     // masternode already holds that key under either encoding, the re-key in UpdateMN() would throw
     // out of block assembly, so reject the migration cleanly here.
-    if (is_v24_active && IsSchemeMigration(dmn->pdmnState->nVersion, opt_ptx->nVersion) &&
+    if (rules.v24 && IsSchemeMigration(dmn->pdmnState->nVersion, opt_ptx->nVersion) &&
         mnList.HasOperatorKeyUnderAnyScheme(dmn->pdmnState->pubKeyOperator.Get(), /*self=*/opt_ptx->proTxHash)) {
         return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-dup-key");
     }
diff --git a/src/evo/specialtxman.h b/src/evo/specialtxman.h
index 7f220d21ab29..95a64bc23157 100644
--- a/src/evo/specialtxman.h
+++ b/src/evo/specialtxman.h
@@ -50,6 +50,8 @@ struct SpecialTxRules {
     bool v24{false};
     //! EvoNodes may register with shared collateral and have multiple owner payouts
     bool evo_shares{false};
+    //! A masternode's primary addresses need not be IPv4
+    bool ipv4_optional{false};
 };
 
 class CSpecialTxProcessor
@@ -183,7 +185,7 @@ bool CheckProRegTx(const CTransaction& tx, gsl::not_null<const CBlockIndex*> pin
                    const CCoinsViewCache& view, const Consensus::Params& consensus_params, SpecialTxRules rules,
                    TxValidationState& state, bool check_sigs);
 bool CheckProUpServTx(const CTransaction& tx, gsl::not_null<const CBlockIndex*> pindexPrev,
-                      CDeterministicMNManager& dmnman, const Consensus::Params& consensus_params, bool is_v24_active,
+                      CDeterministicMNManager& dmnman, const Consensus::Params& consensus_params, SpecialTxRules rules,
                       TxValidationState& state, bool check_sigs);
 bool CheckProUpRegTx(const CTransaction& tx, gsl::not_null<const CBlockIndex*> pindexPrev, CDeterministicMNManager& dmnman,
                      const CCoinsViewCache& view, const Consensus::Params& consensus_params, SpecialTxRules rules,
diff --git a/src/index/addressindex.cpp b/src/index/addressindex.cpp
index 342de4e359d6..8ce3783ea36f 100644
--- a/src/index/addressindex.cpp
+++ b/src/index/addressindex.cpp
@@ -141,11 +141,9 @@ bool AddressIndex::DB::UpdateAddressUnspentIndex(const std::vector<CAddressUnspe
     return CDBWrapper::WriteBatch(batch);
 }
 
-bool AddressIndex::DB::RewindBatch(const std::vector<CAddressIndexEntry>& address_entries,
+void AddressIndex::DB::RewindBatch(CDBBatch& batch, const std::vector<CAddressIndexEntry>& address_entries,
                                    const std::vector<CAddressUnspentIndexEntry>& unspent_entries)
 {
-    CDBBatch batch(*this);
-
     for (const auto& [key, _] : address_entries) {
         batch.Erase(std::make_pair(DB_ADDRESSINDEX, key));
     }
@@ -157,8 +155,6 @@ bool AddressIndex::DB::RewindBatch(const std::vector<CAddressIndexEntry>& addres
             batch.Write(std::make_pair(DB_ADDRESSUNSPENTINDEX, key), value);
         }
     }
-
-    return CDBWrapper::WriteBatch(batch);
 }
 
 AddressIndex::AddressIndex(std::unique_ptr<interfaces::Chain> chain, size_t n_cache_size, bool f_memory, bool f_wipe) :
@@ -285,17 +281,17 @@ bool AddressIndex::CustomRewind(const interfaces::BlockKey& current_tip, const i
 
     // Rewind the unspent index by processing blocks in reverse
     // We need to undo all operations from current_tip back to (but not including) new_tip
-    for (const CBlockIndex* pindex = current_tip_index; pindex != new_tip_index; pindex = pindex->pprev) {
+    return RewindBlockByBlock(current_tip_index, new_tip_index, [&](const CBlockIndex* pindex, CDBBatch& batch) {
         CBlock block;
         if (!node::ReadBlockFromDisk(block, pindex, Params().GetConsensus())) {
-            LogError("%s: Failed to read block %s from disk during rewind\n", __func__,
+            LogError("%s: Failed to read block %s from disk during rewind\n", "CustomRewind",
                      pindex->GetBlockHash().ToString());
             return false;
         }
 
         CBlockUndo blockundo;
         if (pindex->nHeight > 0 && !node::UndoReadFromDisk(blockundo, pindex)) {
-            LogError("%s: Failed to read undo data for block %s during rewind\n", __func__,
+            LogError("%s: Failed to read undo data for block %s during rewind\n", "CustomRewind",
                      pindex->GetBlockHash().ToString());
             return false;
         }
@@ -308,7 +304,7 @@ bool AddressIndex::CustomRewind(const interfaces::BlockKey& current_tip, const i
         // reverse order ensures spends are undone before outputs, preventing phantom UTXOs.
         // blockundo.vtxundo[i] corresponds to block.vtx[i+1] (coinbase skipped)
         if (blockundo.vtxundo.size() != block.vtx.size() - 1) {
-            LogError("%s: Undo data size mismatch for block %s (expected %zu, got %zu)\n", __func__,
+            LogError("%s: Undo data size mismatch for block %s (expected %zu, got %zu)\n", "CustomRewind",
                      pindex->GetBlockHash().ToString(), block.vtx.size() - 1, blockundo.vtxundo.size());
             return false;
         }
@@ -340,7 +336,7 @@ bool AddressIndex::CustomRewind(const interfaces::BlockKey& current_tip, const i
 
             // Undo inputs (restore to unspent index, remove spending from history)
             if (tx->vin.size() != txundo.vprevout.size()) {
-                LogError("%s: Undo data mismatch for tx %s\n", __func__, txhash.ToString());
+                LogError("%s: Undo data mismatch for tx %s\n", "CustomRewind", txhash.ToString());
                 return false;
             }
 
@@ -391,14 +387,9 @@ bool AddressIndex::CustomRewind(const interfaces::BlockKey& current_tip, const i
             }
         }
 
-        // Apply both rewind updates in a single batch to avoid leaving the index half-rewound.
-        if (!m_db->RewindBatch(addressIndex, addressUnspentIndex)) {
-            LogError("%s: Failed to apply address index rewind batch\n", __func__);
-            return false;
-        }
-    }
-
-    return true;
+        m_db->RewindBatch(batch, addressIndex, addressUnspentIndex);
+        return true;
+    });
 }
 
 BaseIndex::DB& AddressIndex::GetDB() const { return *m_db; }
diff --git a/src/index/addressindex.h b/src/index/addressindex.h
index 06497faba7cf..265e5243dbdd 100644
--- a/src/index/addressindex.h
+++ b/src/index/addressindex.h
@@ -54,13 +54,14 @@ class AddressIndex final : public BaseIndex
         /// Update address unspent index (handles both adds and deletes)
         bool UpdateAddressUnspentIndex(const std::vector<CAddressUnspentIndexEntry>& entries);
 
-        /// Atomically erase address history entries and update unspent outputs during rewind.
-        bool RewindBatch(const std::vector<CAddressIndexEntry>& address_entries,
+        /// Add the erasures of address history entries and the unspent output updates of a rewind to batch.
+        void RewindBatch(CDBBatch& batch, const std::vector<CAddressIndexEntry>& address_entries,
                          const std::vector<CAddressUnspentIndexEntry>& unspent_entries);
     };
 
     /// Override to return false - we need undo data
     bool AllowPrune() const override { return false; }
+    bool WritesEagerly() const override { return true; }
 
     /// Write block data to the index databases
     bool CustomAppend(const interfaces::BlockInfo& block) override;
diff --git a/src/index/base.cpp b/src/index/base.cpp
index 61b7e7ea768f..cd7ce2bfdd42 100644
--- a/src/index/base.cpp
+++ b/src/index/base.cpp
@@ -22,8 +22,10 @@
 
 using node::PruneLockInfo;
 using node::ReadBlockFromDisk;
+using node::g_indexes_ready_to_sync;
 
 constexpr uint8_t DB_BEST_BLOCK{'B'};
+constexpr uint8_t DB_UNCOMMITTED_TIP{'U'};
 
 constexpr auto SYNC_LOG_INTERVAL{30s};
 constexpr auto SYNC_LOCATOR_WRITE_INTERVAL{30s};
@@ -46,13 +48,16 @@ BaseIndex::DB::DB(const fs::path& path, size_t n_cache_size, bool f_memory, bool
     CDBWrapper(path, n_cache_size, f_memory, f_wipe, f_obfuscate)
 {}
 
-bool BaseIndex::DB::ReadBestBlock(CBlockLocator& locator) const
+CBlockLocator BaseIndex::DB::ReadBestBlock() const
 {
+    CBlockLocator locator;
+
     bool success = Read(DB_BEST_BLOCK, locator);
     if (!success) {
         locator.SetNull();
     }
-    return success;
+
+    return locator;
 }
 
 void BaseIndex::DB::WriteBestBlock(CDBBatch& batch, const CBlockLocator& locator)
@@ -60,6 +65,23 @@ void BaseIndex::DB::WriteBestBlock(CDBBatch& batch, const CBlockLocator& locator
     batch.Write(DB_BEST_BLOCK, locator);
 }
 
+std::optional<uint256> BaseIndex::DB::ReadUncommittedTip() const
+{
+    uint256 block_hash;
+    if (!Read(DB_UNCOMMITTED_TIP, block_hash)) return std::nullopt;
+    return block_hash;
+}
+
+void BaseIndex::DB::WriteUncommittedTip(CDBBatch& batch, const uint256& block_hash)
+{
+    batch.Write(DB_UNCOMMITTED_TIP, block_hash);
+}
+
+void BaseIndex::DB::EraseUncommittedTip(CDBBatch& batch)
+{
+    batch.Erase(DB_UNCOMMITTED_TIP);
+}
+
 BaseIndex::BaseIndex(std::unique_ptr<interfaces::Chain> chain, std::string name)
     : m_chain{std::move(chain)}, m_name{std::move(name)} {}
 
@@ -71,24 +93,42 @@ BaseIndex::~BaseIndex()
 
 bool BaseIndex::Init()
 {
-    CBlockLocator locator;
-    if (!GetDB().ReadBestBlock(locator)) {
-        locator.SetNull();
-    }
+    const auto locator{GetDB().ReadBestBlock()};
 
     LOCK(cs_main);
     CChain& active_chain = m_chainstate->m_chain;
-    if (locator.IsNull()) {
-        SetBestBlockIndex(nullptr);
-    } else {
-        SetBestBlockIndex(m_chainstate->FindForkInGlobalIndex(locator));
+    const CBlockIndex* locator_index{nullptr};
+    if (!locator.IsNull()) {
+        // Setting the best block to the locator's top block. If it is not part of the
+        // best chain, we will rewind to the fork point during index sync
+        locator_index = m_chainstate->m_blockman.LookupBlockIndex(locator.vHave.at(0));
+        if (!locator_index) {
+            return InitError(strprintf(Untranslated("%s: best block of the index not found. Please rebuild the index."), GetName()));
+        }
+    }
+    const CBlockIndex* resume_block{ResumeBlock(m_chainstate->m_blockman, locator_index)};
+    const auto uncommitted_tip{WritesEagerly() ? GetDB().ReadUncommittedTip() : std::nullopt};
+    if (uncommitted_tip && resume_block == locator_index) {
+        // The entries of the blocks up to it are on disk, but without the blocks the index can't tell whether they
+        // are still on the active chain, nor rewind them.
+        if (!m_chainstate->m_blockman.LookupBlockIndex(*uncommitted_tip)) {
+            return InitError(strprintf(Untranslated("%s: the block the index was last synced to is not found. Please "
+                                                    "rebuild the index."),
+                                       GetName()));
+        }
+        CDBBatch batch(GetDB());
+        GetDB().EraseUncommittedTip(batch);
+        GetDB().WriteBatch(batch);
     }
+    SetBestBlockIndex(resume_block);
 
     // Note: this will latch to true immediately if the user starts up with an empty
     // datadir and an index enabled. If this is the case, indexation will happen solely
     // via `BlockConnected` signals until, possibly, the next restart.
     m_synced = m_best_block_index.load() == active_chain.Tip();
-    if (!m_synced) {
+
+    // Skip pruning check if indexes are not ready to sync (because reindex-chainstate has wiped the chain).
+    if (!m_synced && g_indexes_ready_to_sync) {
         bool prune_violation = false;
         if (!m_best_block_index) {
             // index is not built yet
@@ -133,22 +173,34 @@ static const CBlockIndex* NextSyncBlock(const CBlockIndex* pindex_prev, CChain&
         return chain.Genesis();
     }
 
-    const CBlockIndex* pindex = chain.Next(pindex_prev);
-    if (pindex) {
+    if (const auto* pindex{chain.Next(pindex_prev)}) {
         return pindex;
     }
 
+    // If there is no next block, we might be synced
+    if (pindex_prev == chain.Tip()) {
+        return nullptr;
+    }
+
+    // Since block is not in the chain, return the next block in the chain AFTER the last common ancestor.
+    // Caller will be responsible for rewinding back to the common ancestor.
     return chain.Next(chain.FindFork(pindex_prev));
 }
 
 void BaseIndex::ThreadSync()
 {
+    // Wait for a possible reindex-chainstate to finish until continuing
+    // with the index sync
+    while (!g_indexes_ready_to_sync) {
+        if (!m_interrupt.sleep_for(std::chrono::milliseconds(500))) return;
+    }
+
     const CBlockIndex* pindex = m_best_block_index.load();
     if (!m_synced) {
         auto& consensus_params = Params().GetConsensus();
 
-        std::chrono::steady_clock::time_point last_log_time{0s};
-        std::chrono::steady_clock::time_point last_locator_write_time{0s};
+        auto last_log_time{NodeClock::now()};
+        auto last_locator_write_time{last_log_time};
         while (true) {
             if (m_interrupt) {
                 SetBestBlockIndex(pindex);
@@ -192,14 +244,14 @@ void BaseIndex::ThreadSync()
                 return;
             }
 
-            auto current_time{std::chrono::steady_clock::now()};
-            if (last_log_time + SYNC_LOG_INTERVAL < current_time) {
+            auto current_time{NodeClock::now()};
+            if (current_time - last_log_time >= SYNC_LOG_INTERVAL) {
                 LogPrintf("Syncing %s with block chain from height %d\n",
                           GetName(), pindex->nHeight);
                 last_log_time = current_time;
             }
 
-            if (last_locator_write_time + SYNC_LOCATOR_WRITE_INTERVAL < current_time) {
+            if (current_time - last_locator_write_time >= SYNC_LOCATOR_WRITE_INTERVAL) {
                 SetBestBlockIndex(pindex);
                 last_locator_write_time = current_time;
                 // No need to handle errors in Commit. See rationale above.
@@ -215,47 +267,98 @@ void BaseIndex::ThreadSync()
     }
 }
 
-bool BaseIndex::Commit()
+void BaseIndex::Commit()
 {
     // Don't commit anything if we haven't indexed any block yet
     // (this could happen if init is interrupted).
     bool ok = m_best_block_index != nullptr;
     if (ok) {
+        // Don't commit if the index best block is not an ancestor of the chainstate's last flushed
+        // block. Otherwise, after an unclean shutdown, the index could be
+        // persisted ahead of a chainstate it can no longer roll back to, which
+        // would corrupt indexes with state (e.g. coinstatsindex).
+        const CBlockIndex* index_tip = m_best_block_index.load();
+        const CBlockIndex* last_flushed = WITH_LOCK(::cs_main, return m_chainstate->GetLastFlushedBlock());
+        if (!last_flushed || last_flushed->GetAncestor(index_tip->nHeight) != index_tip) {
+            LogDebug(BCLog::COINDB, "Skipping commit, index is ahead of flushed chainstate (index height %d, last flush at height %d)\n",
+                    index_tip->nHeight, last_flushed ? last_flushed->nHeight : -1);
+            if (WritesEagerly()) {
+                CDBBatch batch(GetDB());
+                GetDB().WriteUncommittedTip(batch, index_tip->GetBlockHash());
+                GetDB().WriteBatch(batch);
+            }
+            return;
+        }
         CDBBatch batch(GetDB());
         ok = CustomCommit(batch);
         if (ok) {
             GetDB().WriteBestBlock(batch, GetLocator(*m_chain, m_best_block_index.load()->GetBlockHash()));
+            if (WritesEagerly()) GetDB().EraseUncommittedTip(batch);
             ok = GetDB().WriteBatch(batch);
         }
     }
     if (!ok) {
         LogError("%s: Failed to commit latest %s state\n", __func__, GetName());
-        return false;
+    }
+}
+
+void BaseIndex::WriteRewindLocator(CDBBatch& batch, const CBlockIndex* new_tip) const
+{
+    const auto above_new_tip{[&](const uint256& block_hash) {
+        const CBlockIndex* block{WITH_LOCK(::cs_main, return m_chainstate->m_blockman.LookupBlockIndex(block_hash))};
+        return block && block->nHeight > new_tip->nHeight && block->GetAncestor(new_tip->nHeight) == new_tip;
+    }};
+    // The committed tip was an ancestor of a flushed block when it was written, so it and new_tip below it are in
+    // the block index after a restart. A committed tip at or below new_tip needs no change.
+    if (const auto locator{GetDB().ReadBestBlock()}; !locator.IsNull() && above_new_tip(locator.vHave.front())) {
+        GetDB().WriteBestBlock(batch, GetLocator(*m_chain, new_tip->GetBlockHash()));
+    }
+    // Init() resumes from the uncommitted tip only while the block index has it, and then new_tip below it too.
+    if (const auto uncommitted_tip{GetDB().ReadUncommittedTip()}; uncommitted_tip && above_new_tip(*uncommitted_tip)) {
+        GetDB().WriteUncommittedTip(batch, new_tip->GetBlockHash());
+    }
+}
+
+const CBlockIndex* BaseIndex::ResumeBlock(const node::BlockManager& blockman, const CBlockIndex* locator_block) const
+{
+    AssertLockHeld(::cs_main);
+    // The entries up to the uncommitted tip are on disk, so resume from it while the block index has it above the
+    // locator. Commit() and rewinds keep the locator below it; one that isn't was left behind by an older binary.
+    const auto uncommitted_tip_hash{WritesEagerly() ? GetDB().ReadUncommittedTip() : std::nullopt};
+    const CBlockIndex* uncommitted_tip{uncommitted_tip_hash ? blockman.LookupBlockIndex(*uncommitted_tip_hash) : nullptr};
+    if (uncommitted_tip && (!locator_block || uncommitted_tip->GetAncestor(locator_block->nHeight) == locator_block)) {
+        return uncommitted_tip;
+    }
+    return locator_block;
+}
+
+bool BaseIndex::RewindBlockByBlock(const CBlockIndex* current_tip, const CBlockIndex* new_tip,
+                                   const std::function<bool(const CBlockIndex* pindex, CDBBatch& batch)>& rewind_block)
+{
+    for (const CBlockIndex* pindex = current_tip; pindex != new_tip; pindex = pindex->pprev) {
+        CDBBatch batch(GetDB());
+        if (!rewind_block(pindex, batch)) return false;
+        WriteRewindLocator(batch, pindex->pprev);
+        if (!GetDB().WriteBatch(batch)) return false;
     }
     return true;
 }
 
 bool BaseIndex::Rewind(const CBlockIndex* current_tip, const CBlockIndex* new_tip)
 {
-    assert(current_tip == m_best_block_index);
     assert(current_tip->GetAncestor(new_tip->nHeight) == new_tip);
 
     if (!CustomRewind({current_tip->GetBlockHash(), current_tip->nHeight}, {new_tip->GetBlockHash(), new_tip->nHeight})) {
         return false;
     }
 
-    // In the case of a reorg, ensure persisted block locator is not stale.
+    // Don't commit here - the committed index state must never be ahead of the
+    // flushed chainstate, otherwise unclean restarts would lead to index corruption.
     // Pruning has a minimum of 288 blocks-to-keep and getting the index
     // out of sync may be possible but a users fault.
     // In case we reorg beyond the pruned depth, ReadBlockFromDisk would
     // throw and lead to a graceful shutdown
     SetBestBlockIndex(new_tip);
-    if (!Commit()) {
-        // If commit fails, revert the best block index to avoid corruption.
-        SetBestBlockIndex(current_tip);
-        return false;
-    }
-
     return true;
 }
 
@@ -438,9 +541,9 @@ void BaseIndex::SetBestBlockIndex(const CBlockIndex* block)
 {
     assert(!m_chainstate->m_blockman.IsPruneMode() || AllowPrune());
 
-    if (AllowPrune() && block) {
+    if (AllowPrune()) {
         PruneLockInfo prune_lock;
-        prune_lock.height_first = block->nHeight;
+        prune_lock.height_first = block ? block->nHeight : 0;
         WITH_LOCK(::cs_main, m_chainstate->m_blockman.UpdatePruneLock(GetName(), prune_lock));
     }
 
diff --git a/src/index/base.h b/src/index/base.h
index db67924d9e75..d59e535f653e 100644
--- a/src/index/base.h
+++ b/src/index/base.h
@@ -12,11 +12,16 @@
 #include <validationinterface.h>
 
 #include <atomic>
+#include <functional>
+#include <optional>
 #include <string>
 
 class CBlock;
 class CBlockIndex;
 class Chainstate;
+namespace node {
+class BlockManager;
+} // namespace node
 namespace interfaces {
 class Chain;
 } // namespace interfaces
@@ -49,10 +54,16 @@ class BaseIndex : public CValidationInterface
            bool f_memory = false, bool f_wipe = false, bool f_obfuscate = false);
 
         /// Read block locator of the chain that the index is in sync with.
-        bool ReadBestBlock(CBlockLocator& locator) const;
+        /// Note, the returned locator will be empty if no record exists.
+        CBlockLocator ReadBestBlock() const;
 
         /// Write block locator of the chain that the index is in sync with.
         void WriteBestBlock(CDBBatch& batch, const CBlockLocator& locator);
+
+        /// The index tip that Commit() last skipped, if no commit has succeeded since. See WritesEagerly().
+        std::optional<uint256> ReadUncommittedTip() const;
+        void WriteUncommittedTip(CDBBatch& batch, const uint256& block_hash);
+        void EraseUncommittedTip(CDBBatch& batch);
     };
 
 private:
@@ -82,20 +93,23 @@ class BaseIndex : public CValidationInterface
     void ThreadSync();
 
     /// Write the current index state (eg. chain block locator and subclass-specific items) to disk.
-    ///
-    /// Recommendations for error handling:
-    /// If called on a successor of the previous committed best block in the index, the index can
-    /// continue processing without risk of corruption, though the index state will need to catch up
-    /// from further behind on reboot. If the new state is not a successor of the previous state (due
-    /// to a chain reorganization), the index must halt until Commit succeeds or else it could end up
-    /// getting corrupted.
-    bool Commit();
+    /// Will skip the commit if no block has been indexed yet or if the index's best block is
+    /// ahead of the chainstate's last flushed block. This avoids persisting state an unclean shutdown
+    /// could not roll back from. A later call commits when the chainstate has flushed far enough.
+    /// Indexes that write eagerly record a skipped tip instead, see WritesEagerly().
+    void Commit();
 
     /// Loop over disconnected blocks and call CustomRewind.
     bool Rewind(const CBlockIndex* current_tip, const CBlockIndex* new_tip);
 
     virtual bool AllowPrune() const = 0;
 
+    /// Whether CustomAppend() persists a block's entries right away. Commit() can't write the locator for a tip
+    /// above the last flush, so for these indexes it records that tip separately, and Init() resumes from it, or
+    /// fails if the block index lost it. Otherwise a restart would resume from the older locator and never rewind the
+    /// entries of blocks above it that are no longer on the active chain.
+    virtual bool WritesEagerly() const { return false; }
+
 protected:
     std::unique_ptr<interfaces::Chain> m_chain;
     Chainstate* m_chainstate{nullptr};
@@ -121,6 +135,22 @@ class BaseIndex : public CValidationInterface
     /// be an ancestor of the current best block.
     [[nodiscard]] virtual bool CustomRewind(const interfaces::BlockKey& current_tip, const interfaces::BlockKey& new_tip) { return true; }
 
+    /// For indexes whose CustomRewind() erases entries: if the committed locator is above new_tip on the same
+    /// branch, move it to new_tip. Commit() may not write new_tip yet (it can be ahead of the last flush), but
+    /// leaving the old locator above erased entries would make an unclean restart resume past them.
+    void WriteRewindLocator(CDBBatch& batch, const CBlockIndex* new_tip) const;
+
+    /// The block Init() resumes from, given the block of the committed locator: the uncommitted tip if the block
+    /// index has it above that block (see WritesEagerly()), otherwise the locator block itself.
+    const CBlockIndex* ResumeBlock(const node::BlockManager& blockman, const CBlockIndex* locator_block) const
+        EXCLUSIVE_LOCKS_REQUIRED(::cs_main);
+
+    /// For indexes that erase per block in CustomRewind(): walk from current_tip down to new_tip and write each
+    /// block's erasures, filled in by rewind_block, in one batch with WriteRewindLocator() for its parent. A rewind
+    /// interrupted between blocks then never leaves the committed locator above erased entries.
+    [[nodiscard]] bool RewindBlockByBlock(const CBlockIndex* current_tip, const CBlockIndex* new_tip,
+                                          const std::function<bool(const CBlockIndex* pindex, CDBBatch& batch)>& rewind_block);
+
     virtual DB& GetDB() const = 0;
 
     /// Get the name of the index for display in logs.
diff --git a/src/index/spentindex.cpp b/src/index/spentindex.cpp
index 64c373a151ff..06af32143709 100644
--- a/src/index/spentindex.cpp
+++ b/src/index/spentindex.cpp
@@ -43,13 +43,11 @@ bool SpentIndex::DB::ReadSpentIndex(const CSpentIndexKey& key, CSpentIndexValue&
     return Read(std::make_pair(DB_SPENTINDEX, key), value);
 }
 
-bool SpentIndex::DB::EraseSpentIndex(const std::vector<CSpentIndexKey>& keys)
+void SpentIndex::DB::EraseSpentIndex(CDBBatch& batch, const std::vector<CSpentIndexKey>& keys)
 {
-    CDBBatch batch(*this);
     for (const auto& key : keys) {
         batch.Erase(std::make_pair(DB_SPENTINDEX, key));
     }
-    return CDBWrapper::WriteBatch(batch);
 }
 
 SpentIndex::SpentIndex(std::unique_ptr<interfaces::Chain> chain, size_t n_cache_size, bool f_memory, bool f_wipe) :
@@ -127,14 +125,14 @@ bool SpentIndex::CustomRewind(const interfaces::BlockKey& current_tip, const int
     assert(current_tip_index->GetAncestor(new_tip_index->nHeight) == new_tip_index);
 
     // Erase spent index entries for blocks being rewound
-    for (const CBlockIndex* pindex = current_tip_index; pindex != new_tip_index; pindex = pindex->pprev) {
+    return RewindBlockByBlock(current_tip_index, new_tip_index, [&](const CBlockIndex* pindex, CDBBatch& batch) {
         // Skip genesis block
-        if (pindex->nHeight == 0) continue;
+        if (pindex->nHeight == 0) return true;
 
         // Read block to get transactions
         CBlock block;
         if (!node::ReadBlockFromDisk(block, pindex, Params().GetConsensus())) {
-            LogError("%s: Failed to read block %s from disk during rewind\n", __func__,
+            LogError("%s: Failed to read block %s from disk during rewind\n", "CustomRewind",
                      pindex->GetBlockHash().ToString());
             return false;
         }
@@ -152,13 +150,9 @@ bool SpentIndex::CustomRewind(const interfaces::BlockKey& current_tip, const int
             }
         }
 
-        if (!keys_to_erase.empty() && !m_db->EraseSpentIndex(keys_to_erase)) {
-            LogError("%s: Failed to erase spent index during rewind\n", __func__);
-            return false;
-        }
-    }
-
-    return true;
+        m_db->EraseSpentIndex(batch, keys_to_erase);
+        return true;
+    });
 }
 
 BaseIndex::DB& SpentIndex::GetDB() const { return *m_db; }
diff --git a/src/index/spentindex.h b/src/index/spentindex.h
index 8a47e5babc8e..b7ba2122c274 100644
--- a/src/index/spentindex.h
+++ b/src/index/spentindex.h
@@ -42,7 +42,7 @@ class SpentIndex final : public BaseIndex
         bool ReadSpentIndex(const CSpentIndexKey& key, CSpentIndexValue& value);
 
         /// Erase spent index entries
-        bool EraseSpentIndex(const std::vector<CSpentIndexKey>& keys);
+        void EraseSpentIndex(CDBBatch& batch, const std::vector<CSpentIndexKey>& keys);
     };
 
     bool CustomAppend(const interfaces::BlockInfo& block) override;
@@ -53,6 +53,7 @@ class SpentIndex final : public BaseIndex
 
     /// SpentIndex cannot work with pruned nodes as it requires UTXO data
     bool AllowPrune() const override { return false; }
+    bool WritesEagerly() const override { return true; }
 
 public:
     /// Constructs a new SpentIndex.
diff --git a/src/index/timestampindex.cpp b/src/index/timestampindex.cpp
index 6f1d9af18952..dca38910eb02 100644
--- a/src/index/timestampindex.cpp
+++ b/src/index/timestampindex.cpp
@@ -41,9 +41,9 @@ void TimestampIndex::DB::ReadRange(uint32_t high, uint32_t low, std::vector<uint
     }
 }
 
-bool TimestampIndex::DB::EraseTimestampIndex(const CTimestampIndexKey& key)
+void TimestampIndex::DB::EraseTimestampIndex(CDBBatch& batch, const CTimestampIndexKey& key)
 {
-    return CDBWrapper::Erase(std::make_pair(DB_TIMESTAMPINDEX, key));
+    batch.Erase(std::make_pair(DB_TIMESTAMPINDEX, key));
 }
 
 TimestampIndex::TimestampIndex(std::unique_ptr<interfaces::Chain> chain, size_t n_cache_size, bool f_memory, bool f_wipe) :
@@ -72,20 +72,17 @@ bool TimestampIndex::CustomRewind(const interfaces::BlockKey& current_tip, const
     const CBlockIndex* new_tip_index = WITH_LOCK(cs_main, return m_chainstate->m_blockman.LookupBlockIndex(new_tip.hash));
     assert(current_tip_index->GetAncestor(new_tip_index->nHeight) == new_tip_index);
 
-    // Erase timestamp index entries for blocks being rewound
+    // Erase timestamp index entries for blocks being rewound, in one batch with the locator
+    CDBBatch batch(GetDB());
     for (const CBlockIndex* pindex = current_tip_index; pindex != new_tip_index; pindex = pindex->pprev) {
         // Skip genesis block
         if (pindex->nHeight == 0) continue;
 
-        CTimestampIndexKey key(pindex->nTime, pindex->GetBlockHash());
-        if (!m_db->EraseTimestampIndex(key)) {
-            LogError("%s: Failed to erase timestamp index for block %s during rewind\n", __func__,
-                     pindex->GetBlockHash().ToString());
-            return false;
-        }
+        m_db->EraseTimestampIndex(batch, CTimestampIndexKey(pindex->nTime, pindex->GetBlockHash()));
     }
 
-    return true;
+    WriteRewindLocator(batch, new_tip_index);
+    return GetDB().WriteBatch(batch);
 }
 
 BaseIndex::DB& TimestampIndex::GetDB() const { return *m_db; }
diff --git a/src/index/timestampindex.h b/src/index/timestampindex.h
index d24e58ebcd0b..0317c89db51c 100644
--- a/src/index/timestampindex.h
+++ b/src/index/timestampindex.h
@@ -37,7 +37,7 @@ class TimestampIndex final : public BaseIndex
         void ReadRange(uint32_t high, uint32_t low, std::vector<uint256>& hashes);
 
         /// Erase timestamp index entry
-        bool EraseTimestampIndex(const CTimestampIndexKey& key);
+        void EraseTimestampIndex(CDBBatch& batch, const CTimestampIndexKey& key);
     };
 
     bool CustomAppend(const interfaces::BlockInfo& block) override;
@@ -49,6 +49,7 @@ class TimestampIndex final : public BaseIndex
 
     /// TimestampIndex works with pruned nodes since it only stores block metadata
     bool AllowPrune() const override { return true; }
+    bool WritesEagerly() const override { return true; }
 
 public:
     /// Constructs a new TimestampIndex.
diff --git a/src/init.cpp b/src/init.cpp
index 27f73133230f..cb6620cbcf7c 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -169,6 +169,7 @@ using node::CalculateCacheSizes;
 using node::DEFAULT_PERSIST_MEMPOOL;
 using node::DEFAULT_PRINTPRIORITY;
 using node::DEFAULT_STOPAFTERBLOCKIMPORT;
+using node::g_indexes_ready_to_sync;
 using node::LoadChainstate;
 using node::MempoolPath;
 using node::ShouldPersistMempool;
@@ -639,7 +640,7 @@ void SetupServerArgs(ArgsManager& argsman)
 
     argsman.AddArg("-addressindex", strprintf("Maintain a full address index, used to query for the balance, txids and unspent outputs for addresses (default: %u)", DEFAULT_ADDRESSINDEX), ArgsManager::ALLOW_ANY, OptionsCategory::INDEXING);
     argsman.AddArg("-reindex", "Rebuild chain state and block index from the blk*.dat files on disk. This will also rebuild active optional indexes.", ArgsManager::ALLOW_ANY, OptionsCategory::INDEXING);
-    argsman.AddArg("-reindex-chainstate", "Rebuild chain state from the currently indexed blocks. When in pruning mode or if blocks on disk might be corrupted, use full -reindex instead. Deactivate all optional indexes before running this.", ArgsManager::ALLOW_ANY, OptionsCategory::INDEXING);
+    argsman.AddArg("-reindex-chainstate", "Rebuild chain state from the currently indexed blocks. When in pruning mode or if blocks on disk might be corrupted, use full -reindex instead.", ArgsManager::ALLOW_ANY, OptionsCategory::INDEXING);
     argsman.AddArg("-spentindex", strprintf("Maintain a full spent index, used to query the spending txid and input index for an outpoint (default: %u)", DEFAULT_SPENTINDEX), ArgsManager::ALLOW_ANY, OptionsCategory::INDEXING);
     argsman.AddArg("-timestampindex", strprintf("Maintain a timestamp index for block hashes, used to query blocks hashes by a range of timestamps (default: %u)", DEFAULT_TIMESTAMPINDEX), ArgsManager::ALLOW_ANY, OptionsCategory::INDEXING);
     argsman.AddArg("-txindex", strprintf("Maintain a full transaction index, used by the getrawtransaction rpc call (default: %u)", DEFAULT_TXINDEX), ArgsManager::ALLOW_ANY, OptionsCategory::INDEXING);
@@ -1372,19 +1373,6 @@ bool AppInitParameterInteraction(const ArgsManager& args)
     if (args.GetBoolArg("-peerbloomfilters", DEFAULT_PEERBLOOMFILTERS))
         nLocalServices = ServiceFlags(nLocalServices | NODE_BLOOM);
 
-    if (args.GetBoolArg("-reindex-chainstate", false)) {
-        // indexes that must be deactivated to prevent index corruption, see #24630
-        if (args.GetBoolArg("-coinstatsindex", DEFAULT_COINSTATSINDEX)) {
-            return InitError(_("-reindex-chainstate option is not compatible with -coinstatsindex. Please temporarily disable coinstatsindex while using -reindex-chainstate, or replace -reindex-chainstate with -reindex to fully rebuild all indexes."));
-        }
-        if (g_enabled_filter_types.count(BlockFilterType::BASIC_FILTER)) {
-            return InitError(_("-reindex-chainstate option is not compatible with -blockfilterindex. Please temporarily disable blockfilterindex while using -reindex-chainstate, or replace -reindex-chainstate with -reindex to fully rebuild all indexes."));
-        }
-        if (args.GetBoolArg("-txindex", DEFAULT_TXINDEX)) {
-            return InitError(_("-reindex-chainstate option is not compatible with -txindex. Please temporarily disable txindex while using -reindex-chainstate, or replace -reindex-chainstate with -reindex to fully rebuild all indexes."));
-        }
-    }
-
     try {
         const bool fQuorumVvecRequestsEnabled{llmq::GetEnabledQuorumVvecSyncEntries(args).size() > 0};
         if (!args.GetBoolArg("-llmq-data-recovery", llmq::DEFAULT_ENABLE_QUORUM_DATA_RECOVERY) && fQuorumVvecRequestsEnabled) {
@@ -2283,6 +2271,9 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
     node.peerman->AddExtraHandler(std::make_unique<SyncManager>(node.peerman.get(), *node.govman, *node.mn_sync, *node.connman, *node.netfulfilledman));
 
     // ********************************************************* Step 8: start indexers
+
+    // If reindex-chainstate was specified, delay syncing indexes until ThreadImport has reindexed the chain
+    if (!fReindexChainState) g_indexes_ready_to_sync = true;
     if (args.GetBoolArg("-txindex", DEFAULT_TXINDEX)) {
         g_txindex = std::make_unique<TxIndex>(interfaces::MakeChain(node), cache_sizes.tx_index, false, fReindex);
         if (!g_txindex->Start()) {
diff --git a/src/interfaces/node.h b/src/interfaces/node.h
index 5713fceaa88e..e68c2ae8e8f3 100644
--- a/src/interfaces/node.h
+++ b/src/interfaces/node.h
@@ -151,10 +151,16 @@ class EVO
     virtual ~EVO() {}
     virtual std::pair<MnListPtr, const CBlockIndex*> getListAtChainTip() = 0;
     virtual ProviderTxCapabilities getProviderTxCapabilities() = 0;
-    //! Validate provider endpoints against a capability snapshot without changing node or wallet state.
-    //! Transaction creation validates them again against the then-active rules.
+    //! Validate provider endpoints against a capability snapshot without changing node or wallet state or
+    //! taking cs_main. Transaction creation validates them again against the then-active rules.
     virtual std::optional<ProviderTxError> validateProviderNetInfo(const ProviderNetInfo& net_info, MnType type,
-                                                                   uint16_t version, bool optional) = 0;
+                                                                   uint16_t version, bool ipv4_optional,
+                                                                   bool optional) = 0;
+    //! The first endpoint a masternode at the chain tip already uses, which a
+    //! registration with a new collateral cannot reuse. Nothing is reported for
+    //! endpoints validateProviderNetInfo refuses.
+    virtual std::optional<std::string> findProviderNetInfoInUse(const ProviderNetInfo& net_info, MnType type,
+                                                                uint16_t version, bool ipv4_optional) = 0;
     //! Successful registration with an existing collateral leaves that coin locked,
     //! including when the signed transaction is returned without submission.
     virtual ProviderTxResult<ProviderTxSubmission> registerMasternode(Wallet& wallet,
diff --git a/src/interfaces/providertx.h b/src/interfaces/providertx.h
index d23c71dee4c2..fe13093c72c1 100644
--- a/src/interfaces/providertx.h
+++ b/src/interfaces/providertx.h
@@ -66,6 +66,8 @@ struct PreparedProviderRegistration {
 struct ProviderTxCapabilities {
     uint16_t version{0};
     bool extended_addresses{false};
+    //! Masternodes may operate without IPv4 (DEPLOYMENT_IPV4_OPTIONAL)
+    bool ipv4_optional{false};
 };
 
 using ProviderPlatformEndpoints = std::variant<std::monostate, uint16_t, std::vector<std::string>>;
diff --git a/src/node/blockstorage.cpp b/src/node/blockstorage.cpp
index ec84092af90c..339a3133e227 100644
--- a/src/node/blockstorage.cpp
+++ b/src/node/blockstorage.cpp
@@ -29,6 +29,7 @@ std::atomic_bool fImporting(false);
 std::atomic_bool fReindex(false);
 bool fPruneMode = false;
 uint64_t nPruneTarget = 0;
+std::atomic_bool g_indexes_ready_to_sync{false};
 
 bool CBlockIndexWorkComparator::operator()(const CBlockIndex* pa, const CBlockIndex* pb) const
 {
@@ -961,5 +962,6 @@ void ThreadImport(ChainstateManager& chainman, std::vector<fs::path> vImportFile
         }
     } // End scope of CImportingNow
     chainman.ActiveChainstate().LoadMempool(mempool_path);
+    g_indexes_ready_to_sync = true;
 }
 } // namespace node
diff --git a/src/node/blockstorage.h b/src/node/blockstorage.h
index ec7ba9c76e81..4318ae57478f 100644
--- a/src/node/blockstorage.h
+++ b/src/node/blockstorage.h
@@ -50,6 +50,7 @@ extern std::atomic_bool fImporting;
 extern std::atomic_bool fReindex;
 extern bool fPruneMode;
 extern uint64_t nPruneTarget;
+extern std::atomic_bool g_indexes_ready_to_sync;
 
 // Because validation code takes pointers to the map's CBlockIndex objects, if
 // we ever switch to another associative container, we need to either use a
diff --git a/src/node/interfaces.cpp b/src/node/interfaces.cpp
index fce39a312367..3ff261132420 100644
--- a/src/node/interfaces.cpp
+++ b/src/node/interfaces.cpp
@@ -275,9 +275,14 @@ class EVOImpl : public EVO
     }
     ProviderTxCapabilities getProviderTxCapabilities() override { return evo::provider::GetCapabilities(context()); }
     std::optional<ProviderTxError> validateProviderNetInfo(const ProviderNetInfo& net_info, MnType type,
-                                                           uint16_t version, bool optional) override
+                                                           uint16_t version, bool ipv4_optional, bool optional) override
     {
-        return evo::provider::ValidateNetInfo(net_info, type, version, optional);
+        return evo::provider::ValidateNetInfo(net_info, type, version, ipv4_optional, optional);
+    }
+    std::optional<std::string> findProviderNetInfoInUse(const ProviderNetInfo& net_info, MnType type, uint16_t version,
+                                                        bool ipv4_optional) override
+    {
+        return evo::provider::FindNetInfoInUse(context(), net_info, type, version, ipv4_optional);
     }
     ProviderTxResult<ProviderTxSubmission> registerMasternode(Wallet& wallet, const ProviderRegistrationRequest& request) override
     {
diff --git a/src/qt/guiutil.cpp b/src/qt/guiutil.cpp
index 7639b2fab956..f94560be25ad 100644
--- a/src/qt/guiutil.cpp
+++ b/src/qt/guiutil.cpp
@@ -598,6 +598,10 @@ void openConfigfile()
 {
     fs::path pathConfig = gArgs.GetConfigFilePath();
 
+    /* Create the file */
+    std::ofstream configFile{pathConfig, std::ios_base::app};
+    configFile.close();
+
     /* Open dash.conf with the associated application */
     if (fs::exists(pathConfig)) {
         // Workaround for macOS-specific behavior; see #15409.
diff --git a/src/qt/masternodedialogs.cpp b/src/qt/masternodedialogs.cpp
index 016433e8c08b..d2432d64a1e2 100644
--- a/src/qt/masternodedialogs.cpp
+++ b/src/qt/masternodedialogs.cpp
@@ -411,9 +411,15 @@ UpdateServiceDialog::UpdateServiceDialog(interfaces::Node& node, WalletModel* wa
         form->addRow(tr("Operator payout address:"), m_operator_payout_edit);
     }
 
-    m_fee_source = addFeeSourceRow(form, tr("Automatic uses the current operator payout, then the masternode payout. "
-                                            "Select an address only "
-                                            "to override that choice."));
+    // Without an operator payout, Automatic funds from the first share's reward
+    // address, which is usually another wallet's: pay from this wallet instead
+    if (entry.isShared()) {
+        m_fee_source = addFeeSourceRow(form, tr("The fee is paid from this address of your wallet."));
+        m_fee_source->setAutomaticOption(QString{});
+    } else {
+        m_fee_source = addFeeSourceRow(form, tr("Automatic uses the current operator payout, then the masternode "
+                                                "payout. Select an address only to override that choice."));
+    }
 
     setupUi(m_type == MnType::Evo ? tr("Update EvoNode Service") : tr("Update Masternode Service"),
             tr("Update the registered service endpoints. A successful update also revives a PoSe-banned "
@@ -450,7 +456,8 @@ std::optional<interfaces::ProviderNetInfo> UpdateServiceDialog::buildNetInfo(QSt
         }
     }
     if (const auto validation_error{
-            m_node.evo().validateProviderNetInfo(net_info, m_type, m_capabilities.version, /*optional=*/false)}) {
+            m_node.evo().validateProviderNetInfo(net_info, m_type, m_capabilities.version,
+                                                 m_capabilities.ipv4_optional, /*optional=*/false)}) {
         error = MasternodeOperationRunner::errorText(*validation_error);
         return std::nullopt;
     }
@@ -664,9 +671,15 @@ RevokeDialog::RevokeDialog(interfaces::Node& node, WalletModel* wallet_model, co
     connect(m_operator_key, &OperatorSecretWidget::changed, this, &RevokeDialog::validate);
     form->addRow(tr("Operator key:"), m_operator_key);
 
-    m_fee_source = addFeeSourceRow(form, tr("Automatic uses the current operator payout, then the masternode payout. "
-                                            "Select an address only "
-                                            "to override that choice."));
+    // Without an operator payout, Automatic funds from the first share's reward
+    // address, which is usually another wallet's: pay from this wallet instead
+    if (entry.isShared()) {
+        m_fee_source = addFeeSourceRow(form, tr("The fee is paid from this address of your wallet."));
+        m_fee_source->setAutomaticOption(QString{});
+    } else {
+        m_fee_source = addFeeSourceRow(form, tr("Automatic uses the current operator payout, then the masternode "
+                                                "payout. Select an address only to override that choice."));
+    }
 
     setupUi(tr("Revoke Masternode Service"),
             tr("Revoking clears the service address and PoSe-bans the masternode until its owner changes the "
diff --git a/src/qt/masternodeoperationrunner.cpp b/src/qt/masternodeoperationrunner.cpp
index 59af849d2792..cf3f78b166b2 100644
--- a/src/qt/masternodeoperationrunner.cpp
+++ b/src/qt/masternodeoperationrunner.cpp
@@ -226,6 +226,7 @@ const KnownError KNOWN_ERRORS[]{
     {"bad-protx-version", QT_TRANSLATE_NOOP("MasternodeOperationRunner", "The network does not accept this transaction version yet. Wait for the network upgrade that introduces it to activate.")},
     {"too-early", QT_TRANSLATE_NOOP("MasternodeOperationRunner", "This feature is not active on the network yet. Wait for the network upgrade that introduces it to activate.")},
     {"bad-prodis-dup", QT_TRANSLATE_NOOP("MasternodeOperationRunner", "A dissolution for this masternode is already pending.")},
+    {"bad-prodis-penalty-floor", QT_TRANSLATE_NOOP("MasternodeOperationRunner", "This dissolution pays a share less than the network requires: its full principal plus its part of any early-exit penalty. A dissolution that pays no penalty is accepted only once the early period has ended; if it has already ended, prepare a new dissolution.")},
 };
 } // namespace
 
diff --git a/src/qt/masternodewizard.cpp b/src/qt/masternodewizard.cpp
index 8bf184d891d2..2278492d37fd 100644
--- a/src/qt/masternodewizard.cpp
+++ b/src/qt/masternodewizard.cpp
@@ -492,7 +492,7 @@ QWidget* RegisterMasternodeWizard::createPlatformPage()
         card.body_layout->addWidget(m_platform_p2p);
         card.body_layout->addWidget(makeHint(tr("Platform HTTPS API"), m_platform_addr_box));
         m_platform_https = new QLineEdit(card.body);
-        m_platform_https->setPlaceholderText(QString("platform.example.org:443"));
+        m_platform_https->setPlaceholderText(QString("1.2.3.4:443"));
         card.body_layout->addWidget(m_platform_https);
         layout->addWidget(m_platform_addr_box);
     }
@@ -849,6 +849,7 @@ void RegisterMasternodeWizard::enterPage(Page page)
         const auto capabilities{m_node.evo().getProviderTxCapabilities()};
         const bool v3{capabilities.extended_addresses};
         m_platform_provider_version = capabilities.version;
+        m_platform_ipv4_optional = capabilities.ipv4_optional;
         m_platform_extended_addresses = v3;
         m_platform_addr_box->setVisible(v3);
         m_platform_port_box->setVisible(!v3);
@@ -926,9 +927,9 @@ bool RegisterMasternodeWizard::validatePage(Page page, QString& err)
         } else if (!list.isEmpty()) {
             interfaces::ProviderNetInfo core_only;
             for (const QString& entry : list) core_only.core_p2p.push_back(entry.toStdString());
-            const uint16_t version{m_node.evo().getProviderTxCapabilities().version};
+            const auto capabilities{m_node.evo().getProviderTxCapabilities()};
             if (const auto error{m_node.evo().validateProviderNetInfo(
-                    core_only, MnType::Regular, version, /*optional=*/true)}) {
+                    core_only, MnType::Regular, capabilities.version, capabilities.ipv4_optional, /*optional=*/true)}) {
                 err = QString::fromStdString(error->message.translated);
             }
         }
@@ -1047,11 +1048,15 @@ interfaces::ProviderNetInfo RegisterMasternodeWizard::providerNetInfo() const
 
 bool RegisterMasternodeWizard::validateProviderNetInfo(bool optional, QString& err) const
 {
-    const uint16_t version{isEvo() && m_platform_provider_version != 0 ?
-                               m_platform_provider_version :
-                               m_node.evo().getProviderTxCapabilities().version};
-    if (const auto error{m_node.evo().validateProviderNetInfo(
-            providerNetInfo(), isEvo() ? MnType::Evo : MnType::Regular, version, optional)}) {
+    // The Platform page pins the rules it was entered with, so typing there doesn't wait for cs_main
+    const interfaces::ProviderTxCapabilities pinned{.version = m_platform_provider_version,
+                                                    .extended_addresses = m_platform_extended_addresses,
+                                                    .ipv4_optional = m_platform_ipv4_optional};
+    const auto capabilities{isEvo() && m_platform_provider_version != 0 ? pinned
+                                                                        : m_node.evo().getProviderTxCapabilities()};
+    const MnType type{isEvo() ? MnType::Evo : MnType::Regular};
+    if (const auto error{m_node.evo().validateProviderNetInfo(providerNetInfo(), type, capabilities.version,
+                                                              capabilities.ipv4_optional, optional)}) {
         err = QString::fromStdString(error->message.translated);
         return false;
     }
diff --git a/src/qt/masternodewizard.h b/src/qt/masternodewizard.h
index eec0dbe16af2..e2187adbe100 100644
--- a/src/qt/masternodewizard.h
+++ b/src/qt/masternodewizard.h
@@ -160,6 +160,7 @@ private Q_SLOTS:
     bool m_registered{false};
     bool m_platform_extended_addresses{false};
     uint16_t m_platform_provider_version{0};
+    bool m_platform_ipv4_optional{false};
     std::optional<Page> m_validation_page;
 
     QStackedWidget* m_pages;
diff --git a/src/qt/mnsharesession.cpp b/src/qt/mnsharesession.cpp
index eaf74965fbba..cf96952a193d 100644
--- a/src/qt/mnsharesession.cpp
+++ b/src/qt/mnsharesession.cpp
@@ -1344,6 +1344,20 @@ bool MnShareSession::adoptLockedTerms(const MnShareSession& other, QString& erro
     return true;
 }
 
+bool MnShareSession::hasShare(const Share& share) const
+{
+    return std::any_of(m_shares.begin(), m_shares.end(), [&](const Share& ours) {
+        return ours.ownerAddress == share.ownerAddress && SameShare(ours, share);
+    });
+}
+
+bool MnShareSession::hasContribution(const Contribution& contribution) const
+{
+    return std::any_of(m_contributions.begin(), m_contributions.end(), [&](const Contribution& ours) {
+        return ours.label == contribution.label && SameContribution(ours, contribution);
+    });
+}
+
 MnShareSession::MergeResult MnShareSession::mergeEnvelope(const MnShareSession& other, QString& error)
 {
     if (other.m_session_id != m_session_id) {
diff --git a/src/qt/mnsharesession.h b/src/qt/mnsharesession.h
index 0525c8097d62..0dc8f0176ce0 100644
--- a/src/qt/mnsharesession.h
+++ b/src/qt/mnsharesession.h
@@ -311,6 +311,11 @@ class MnShareSession
     //! carries any skipped-signature warnings even on success.
     MergeResult mergeEnvelope(const MnShareSession& other, QString& error);
 
+    //! Whether a row with `share`'s owner address has the same amount and addresses here
+    bool hasShare(const Share& share) const;
+    //! Whether a contribution with `contribution`'s label spends the same coins and pays the same change here
+    bool hasContribution(const Contribution& contribution) const;
+
     //! Record the shared_combine result and advance to Combined
     bool setCombinedTx(const QString& tx_hex, QString& error);
     //! Record the fully signed funding transaction and advance to FundingSigned
diff --git a/src/qt/sharedmncreatedialog.cpp b/src/qt/sharedmncreatedialog.cpp
index 36e8e6006281..5588e7236022 100644
--- a/src/qt/sharedmncreatedialog.cpp
+++ b/src/qt/sharedmncreatedialog.cpp
@@ -151,6 +151,16 @@ bool ContributesOutpoint(const std::vector<MnShareSession::Input>& inputs, const
     });
 }
 
+//! True when `contribution` is `released`'s participant spending any of the
+//! coins `released` still stands for
+bool SpendsReleasedCoins(const MnShareSession::Contribution& contribution, const MnShareSession::Contribution& released)
+{
+    return contribution.label == released.label &&
+           std::any_of(contribution.inputs.begin(), contribution.inputs.end(), [&](const MnShareSession::Input& input) {
+               return ContributesOutpoint(released.inputs, COutPoint(uint256S(input.txid.toStdString()), input.vout));
+           });
+}
+
 //! scriptSig presence per input of a serialized transaction, keyed by
 //! lowercase "txid:vout"; an empty map when the hex does not decode
 std::map<QString, bool> InputSignatureMap(const QString& tx_hex)
@@ -173,6 +183,23 @@ QString ShareName(const MnShareSession& session, int index)
     }
     return QObject::tr("Share %1 of %2").arg(index + 1).arg(session.shares().size());
 }
+
+//! Why the network would refuse these service addresses because a registered
+//! masternode already uses one of them (empty = none is in use)
+QString ServiceInUseProblem(interfaces::Node& node, const QString& services)
+{
+    interfaces::ProviderNetInfo net_info;
+    for (const QString& entry : MasternodeWidgetUtil::tokenizeEndpointList(services)) {
+        net_info.core_p2p.push_back(entry.toStdString());
+    }
+    const auto capabilities{node.evo().getProviderTxCapabilities()};
+    const auto in_use{node.evo().findProviderNetInfoInUse(net_info, MnType::Regular, capabilities.version,
+                                                          capabilities.ipv4_optional)};
+    if (!in_use) return {};
+    return SharedMnCreateDialog::tr("%1 is already the service address of a registered masternode. Every service "
+                                    "address must be unique on the network.")
+        .arg(QString::fromStdString(*in_use));
+}
 } // anonymous namespace
 
 //! Keeps the wallet unlocked on the GUI thread while this wallet signs.
@@ -460,6 +487,11 @@ QWidget* SharedMnCreateDialog::createParticipantsPage()
         if (selected < 0 || static_cast<size_t>(selected) >= shares.size() || shares.size() <= CProRegTx::MIN_SHARES) {
             return;
         }
+        if (selected == m_my_share && myContribution() != nullptr) {
+            showError(tr("Your coins are reserved for this row. Release them on the contribution page before "
+                         "removing it."));
+            return;
+        }
         shares.erase(shares.begin() + selected);
         if (m_my_share == selected) {
             m_my_share = -1;
@@ -733,6 +765,7 @@ QWidget* SharedMnCreateDialog::createContributionPage()
                 }
             });
             row->addWidget(fresh);
+            m_new_address_buttons.push_back(fresh);
             box->addLayout(row);
         };
         address_row(tr("Owner address:"),
@@ -922,6 +955,12 @@ QWidget* SharedMnCreateDialog::createApprovalsPage()
     SharedMnMakeSecondary(m_unlock_button);
     connect(m_unlock_button, &QPushButton::clicked, this, &SharedMnCreateDialog::unlockTerms);
     row->addWidget(m_unlock_button);
+    // The coordinator has no waiting page, and a session can stall here or on
+    // the Signatures page for good, e.g. when somebody spends a reserved coin
+    m_approvals_release_button = new QPushButton(tr("Release my coins"), page);
+    m_approvals_release_button->setFlat(true);
+    connect(m_approvals_release_button, &QPushButton::clicked, this, &SharedMnCreateDialog::releaseReservedCoins);
+    row->addWidget(m_approvals_release_button);
     row->addStretch();
     layout->addLayout(row);
     return page;
@@ -958,6 +997,10 @@ QWidget* SharedMnCreateDialog::createSignaturesPage()
     m_copy_signing_button = new QPushButton(tr("Copy Signing Request"), page);
     connect(m_copy_signing_button, &QPushButton::clicked, this, [this] { copySession(tr("Signing Request")); });
     row->addWidget(m_copy_signing_button);
+    m_signatures_release_button = new QPushButton(tr("Release my coins"), page);
+    m_signatures_release_button->setFlat(true);
+    connect(m_signatures_release_button, &QPushButton::clicked, this, &SharedMnCreateDialog::releaseReservedCoins);
+    row->addWidget(m_signatures_release_button);
     row->addStretch();
     layout->addLayout(row);
     return page;
@@ -1283,10 +1326,16 @@ void SharedMnCreateDialog::enterPage(Page page)
     refreshBoards();
     updateProgress();
     updateButtons();
-    // The exception to the rule above: a funding transaction this wallet must
-    // not sign is about the session, not about the page that happens to be on
-    // screen, and it must be read before anything is signed
-    if (!m_funding_refusal.isEmpty()) showError(m_funding_refusal);
+    // The exceptions to the rule above: a session that can no longer complete,
+    // or a funding transaction this wallet must not sign, is about the session,
+    // not about the page that happens to be on screen. The first is why the
+    // primary button says "Start Over"; the second must be read before
+    // anything is signed.
+    if (!m_dead_reason.isEmpty()) {
+        showError(m_dead_reason);
+    } else if (!m_funding_refusal.isEmpty()) {
+        showError(m_funding_refusal);
+    }
 }
 
 bool SharedMnCreateDialog::validatePage(Page page, QString& err)
@@ -1331,10 +1380,12 @@ bool SharedMnCreateDialog::validatePage(Page page, QString& err)
         for (const QString& entry : MasternodeWidgetUtil::tokenizeEndpointList(m_service_edit->text())) {
             net_info.core_p2p.push_back(entry.toStdString());
         }
-        const uint16_t version{m_node.evo().getProviderTxCapabilities().version};
-        if (const auto error{
-                m_node.evo().validateProviderNetInfo(net_info, MnType::Regular, version, /*optional=*/true)}) {
+        const auto capabilities{m_node.evo().getProviderTxCapabilities()};
+        if (const auto error{m_node.evo().validateProviderNetInfo(net_info, MnType::Regular, capabilities.version,
+                                                                  capabilities.ipv4_optional, /*optional=*/true)}) {
             err = QString::fromStdString(error->message.translated);
+        } else {
+            err = ServiceInUseProblem(m_node, m_service_edit->text());
         }
         break;
     }
@@ -1366,11 +1417,39 @@ bool SharedMnCreateDialog::validatePage(Page page, QString& err)
             err = tr("Enter a valid reward address (P2PKH or P2SH), or leave it empty.");
             break;
         }
-        if (!reward.isEmpty() &&
-            (reward == m_session.terms().votingAddress || reward == owner ||
-             std::any_of(m_session.shares().begin(), m_session.shares().end(),
-                         [&](const auto& share) { return !share.ownerAddress.isEmpty() &&
-                                                         share.ownerAddress == reward; }))) {
+        // The payout rules Lock enforces, applied to the rows known so far
+        const auto& shares{m_session.shares()};
+        const auto is_key_address{[&](const QString& address) {
+            if (address == m_session.terms().votingAddress || address == owner) return true;
+            for (size_t i = 0; i < shares.size(); ++i) {
+                // This row's owner is the field above; the recorded one may be stale
+                if (static_cast<int>(i) != m_my_share && shares[i].ownerAddress == address) return true;
+            }
+            return false;
+        }};
+        for (size_t i = 0; i < shares.size(); ++i) {
+            if (static_cast<int>(i) != m_my_share &&
+                (shares[i].refundAddress == owner || shares[i].rewardAddress == owner)) {
+                err = tr("%1 already pays a refund or reward to this owner address. The owner address must differ from "
+                         "every refund and reward address.")
+                          .arg(ShareName(m_session, static_cast<int>(i)));
+                break;
+            }
+        }
+        if (!err.isEmpty()) break;
+        if (is_key_address(refund)) {
+            err = tr("The refund address must differ from the voting address and every owner address.");
+            break;
+        }
+        for (size_t i = 0; i < shares.size(); ++i) {
+            if (static_cast<int>(i) != m_my_share && shares[i].refundAddress == refund) {
+                err = tr("%1 already uses this refund address. Every refund address must be unique.")
+                          .arg(ShareName(m_session, static_cast<int>(i)));
+                break;
+            }
+        }
+        if (!err.isEmpty()) break;
+        if (!reward.isEmpty() && is_key_address(reward)) {
             err = tr("The reward address must differ from the voting address and every owner address.");
             break;
         }
@@ -1445,7 +1524,7 @@ void SharedMnCreateDialog::updateButtons()
             next_text = tr("Approve");
         } else {
             next_visible = allApproved();
-            next_text = tr("Retry");
+            next_text = m_coins_released ? tr("Reserve and Sign") : tr("Retry");
         }
         break;
     case PageSignatures:
@@ -1629,6 +1708,11 @@ void SharedMnCreateDialog::onNext()
                 if (allApproved()) runCombineAndSign();
             });
         } else {
+            // The user asked for this, so coins released earlier are reserved again
+            if (m_coins_released) {
+                m_coins_released = false;
+                refreshContributedCoinLocks();
+            }
             runCombineAndSign();
         }
         return;
@@ -1640,6 +1724,15 @@ void SharedMnCreateDialog::onNext()
         }
         return;
     case PageWaitBroadcast:
+        // Until the registration appears the coins stay reserved, which is the
+        // user's choice to make, as it is for Cancel
+        if (hasLockedContributedCoins()) {
+            reject();
+            return;
+        }
+        m_finished = true;
+        accept();
+        return;
     case PageComplete:
         m_finished = true;
         accept();
@@ -1723,13 +1816,16 @@ void SharedMnCreateDialog::refreshShareTable()
         m_share_table->resizeRowsToContents();
     }
     for (int row = 0; row < rows; ++row) {
+        // The coins reserved for this wallet's row pay its amount, sized when
+        // they were reserved, and are recorded under its name
+        const bool held{reserved && row == m_my_share};
         if (auto* name = qobject_cast<QLineEdit*>(m_share_table->cellWidget(row, SHARE_COL_NAME))) {
             if (name->text() != shares[row].label) name->setText(shares[row].label);
-            name->setReadOnly(!editable);
+            name->setReadOnly(!editable || held);
         }
         if (auto* amount = qobject_cast<BitcoinAmountField*>(m_share_table->cellWidget(row, SHARE_COL_AMOUNT))) {
             if (amount->value() != shares[row].amount) amount->setValue(shares[row].amount);
-            amount->setEnabled(editable);
+            amount->setEnabled(editable && !held);
         }
         if (auto* me = qobject_cast<QRadioButton*>(m_me_group->button(row))) {
             me->setChecked(row == m_my_share);
@@ -1859,8 +1955,11 @@ void SharedMnCreateDialog::refreshContributionPage()
     const bool reserved{mine != nullptr};
     if (reserved) {
         CAmount total{0};
+        bool valued{true};
         for (const auto& input : mine->inputs) {
-            if (const auto value{resolveInputValue(input)}) total += *value;
+            const auto value{resolveInputValue(input)};
+            valued = valued && value.has_value();
+            total += value.value_or(0);
         }
         QString text{tr("Reserved — these coins cannot be spent until the session ends or you release them.")};
         text += QLatin1Char('\n');
@@ -1870,6 +1969,18 @@ void SharedMnCreateDialog::refreshContributionPage()
                           .arg(coins, FormatAmount(m_wallet_model, total),
                                FormatAmount(m_wallet_model, mine->changeAmount))
                     : tr("Uses %1 (%2), with no change left over.").arg(coins, FormatAmount(m_wallet_model, total));
+        text += QLatin1Char('\n');
+        // The session does not record the fee, so a reopened reservation may pay
+        // more than the field shows. Only the field sets what may be signed, and
+        // what the coins pay beyond the share need not all be fee.
+        const CAmount paid{total - (mine->hasChange ? mine->changeAmount : 0) - shares[m_my_share].amount};
+        if (coordinator && valued && paid >= 0 && paid != m_fee_field->value()) {
+            text += tr("These coins pay %1 beyond your share, not the %2 Network fee shown below.")
+                        .arg(FormatAmount(m_wallet_model, paid), FormatAmount(m_wallet_model, m_fee_field->value()));
+            text += QLatin1Char('\n');
+        }
+        text += coordinator ? tr("To change your addresses or the network fee, release the coins first.")
+                            : tr("To change your addresses, release the coins first.");
         m_coins_label->setText(text);
     } else {
         const CAmount target{contributionTarget()};
@@ -1897,9 +2008,15 @@ void SharedMnCreateDialog::refreshContributionPage()
     m_release_button->setVisible(reserved);
     m_release_button->setEnabled(editable);
     m_who_am_i_combo->setEnabled(editable && !reserved);
+    // The reservation was made for these addresses and this fee, so they stay
+    // as reserved until the coins are released
     for (QValidatedLineEdit* const edit : {m_owner_edit, m_refund_edit, m_reward_edit}) {
         edit->setReadOnly(reserved || !editable);
     }
+    for (QPushButton* const button : m_new_address_buttons) {
+        button->setEnabled(!reserved && editable);
+    }
+    m_fee_field->setEnabled(!reserved && editable);
 }
 
 void SharedMnCreateDialog::refreshInvitePage()
@@ -1924,6 +2041,7 @@ void SharedMnCreateDialog::refreshApprovalsPage()
     m_unlock_button->setVisible(coordinator && m_session.stage() != MnShareSession::Stage::Combined &&
                                 m_session.stage() != MnShareSession::Stage::FundingSigned &&
                                 m_session.stage() != MnShareSession::Stage::Broadcast);
+    m_approvals_release_button->setVisible(hasLockedContributedCoins());
     m_prepare_warning_label->setVisible(!m_prepare_warning.isEmpty());
     m_prepare_warning_label->setText(m_prepare_warning);
     refreshTermSheets();
@@ -1938,6 +2056,7 @@ void SharedMnCreateDialog::refreshSignaturesPage()
                          "in any order.")
                     : tr("Signs the coins you reserved. Your signature only spends them into this registration."));
     m_copy_signing_button->setVisible(coordinator);
+    m_signatures_release_button->setVisible(hasLockedContributedCoins());
 
     const auto signature_map{InputSignatureMap(m_session.protxHex())};
     const auto [signed_inputs, total_inputs]{fundingSignatureCount(m_my_share, signature_map)};
@@ -2237,6 +2356,8 @@ void SharedMnCreateDialog::startSession()
         return;
     }
     unlockAllContributedCoins();
+    m_coins_released = false;
+    m_released_contributions.clear();
     m_session = MnShareSession();
     m_role = Role::Coordinator;
     m_my_share = 0;
@@ -2244,6 +2365,7 @@ void SharedMnCreateDialog::startSession()
     m_dead_reason.clear();
     m_funding_refusal.clear();
     m_replies_absorbed_revision = -1;
+    m_invitation_revision = -1;
     m_session_imported = false;
     m_operator_key_from_import = false;
 
@@ -2282,6 +2404,11 @@ void SharedMnCreateDialog::lockTerms()
         showError(problems.join(QLatin1Char('\n')));
         return;
     }
+    // A masternode may have taken the service address since the settings page
+    if (const QString in_use{ServiceInUseProblem(m_node, m_session.terms().coreP2PAddrs)}; !in_use.isEmpty()) {
+        showError(in_use);
+        return;
+    }
     bool fatal{false};
     const QString funding{fundingCheck(fatal)};
     if (fatal) {
@@ -2613,6 +2740,10 @@ bool SharedMnCreateDialog::signOwnFundingInputs(bool& complete, QString& error)
         error = tr("Signing failed: %1").arg(apply_error);
         return false;
     }
+    // Signing commits these coins to the registration, so they are reserved
+    // again even if they were released before
+    m_coins_released = false;
+    refreshContributedCoinLocks();
     m_dirty = true;
     return true;
 }
@@ -2620,6 +2751,15 @@ bool SharedMnCreateDialog::signOwnFundingInputs(bool& complete, QString& error)
 void SharedMnCreateDialog::runCombineAndSign()
 {
     if (m_busy || m_role != Role::Coordinator || !allApproved()) return;
+    // Coins the user released are signed only once they reserve them again
+    if (m_coins_released) {
+        updateButtons();
+        if (m_error_label->text().isEmpty()) {
+            showStatus(tr("All participants approved. Your coins were released, so nothing was signed. Press "
+                          "\"Reserve and Sign\" to reserve them again and continue."));
+        }
+        return;
+    }
     const auto sign_and_advance = [this] {
         if (m_session.stage() == MnShareSession::Stage::Combined) {
             bool complete{false};
@@ -2815,7 +2955,7 @@ void SharedMnCreateDialog::copySession(const QString& what)
     refreshWaitingPages();
 }
 
-void SharedMnCreateDialog::saveSession()
+bool SharedMnCreateDialog::saveSession()
 {
     if (operatorSecretUnsaved()) {
         // The session file carries only the operator public key, so a file
@@ -2823,21 +2963,22 @@ void SharedMnCreateDialog::saveSession()
         goToPage(PageSecret);
         showError(tr("Save the operator secret key first. It is shown only here, and the session file does not "
                      "carry it: without it the masternode could never be run."));
-        return;
+        return false;
     }
     const QString suggested{QStringLiteral("shared-mn-session-%1.json").arg(m_session.sessionCode())};
     const QString filename{GUIUtil::getSaveFileName(this, tr("Save shared masternode message"), suggested,
                                                     tr("Session files (*.json)"), nullptr)};
-    if (filename.isEmpty()) return;
+    if (filename.isEmpty()) return false;
     QFile file(filename);
     if (!file.open(QIODevice::WriteOnly | QIODevice::Truncate | QIODevice::Text)) {
         showError(tr("Could not open %1 for writing.").arg(filename));
-        return;
+        return false;
     }
     file.write(m_session.toJsonString().toUtf8());
     file.close();
     m_dirty = false;
     showStatus(tr("Saved · Session %1 · Code %2").arg(m_session.sessionCode(), m_session.fingerprint()));
+    return true;
 }
 
 void SharedMnCreateDialog::onSave()
@@ -2906,23 +3047,26 @@ void SharedMnCreateDialog::handleImportedText(const QString& text)
         return;
     }
     const QString warning{imported.importWarning()};
+    // An error left by an earlier message no longer applies; one set below is this copy's refusal
+    showError(QString());
     if (m_role == Role::Undecided) {
         replaceSession(imported);
     } else {
         absorbSession(imported);
     }
-    // Both of those land on another page, which clears the message lines
-    if (!warning.isEmpty()) showStatus(warning);
+    // Both of those land on another page, which clears the message lines. A
+    // refused copy leaves its reason up instead, which the warning must not replace.
+    if (!warning.isEmpty() && m_error_label->text().isEmpty()) showStatus(warning);
 }
 
-void SharedMnCreateDialog::replaceSession(const MnShareSession& imported)
+void SharedMnCreateDialog::replaceSession(const MnShareSession& imported, int my_share)
 {
     unlockAllContributedCoins();
     const bool ours{coordinatedHere(imported)};
     m_session = imported;
     if (m_role == Role::Undecided) m_role = ours ? Role::Coordinator : Role::Participant;
     m_session_imported = true;
-    m_my_share = -1;
+    m_my_share = my_share;
     m_prepare_warning.clear();
     m_dead_reason.clear();
     m_funding_refusal.clear();
@@ -2942,11 +3086,17 @@ void SharedMnCreateDialog::replaceSession(const MnShareSession& imported)
     }
 
     inferMyShare();
+    // A copy that already holds this wallet's answer is its own saved session,
+    // whose revision counts its own edits and says nothing about the invitation
+    const bool answered{m_my_share >= 0 && !m_session.shares()[m_my_share].ownerAddress.isEmpty()};
+    m_invitation_revision = answered ? -1 : m_session.revision();
     checkSessionLiveness();
     checkOwnFunding();
     if (m_dead_reason.isEmpty()) refreshContributedCoinLocks();
-    rebuildOrder();
+    // Pushing the session to the widgets decides whether the operator key came
+    // with it, and so whether the page order still needs the secret gate
     refreshAll();
+    rebuildOrder();
     const QString received{tr("Received %1 · Code %2")
                                .arg(messageName(m_session, /*from_coordinator=*/true), m_session.fingerprint())};
     for (const auto& [board_page, board] : m_boards) {
@@ -2977,6 +3127,113 @@ void SharedMnCreateDialog::replaceSession(const MnShareSession& imported)
     }
 }
 
+void SharedMnCreateDialog::followNewerInvitation(const MnShareSession& imported)
+{
+    // The coordinator edited the draft. A row this wallet filled in comes back
+    // either as it was sent, or still empty when the reply was not absorbed
+    // yet. Its addresses, amount and coins always stay the ones this wallet
+    // sent: they are what the next reply repeats, and what the locked terms and
+    // the funding checks are later held to.
+    const auto& shares{m_session.shares()};
+    const auto ours = [&](size_t i) { return !shares[i].ownerAddress.isEmpty() && !shareTakenByOther(i); };
+    MnShareSession revised{imported};
+    auto& rows{revised.shares()};
+    for (size_t i = 0; i < shares.size(); ++i) {
+        const auto& mine{shares[i]};
+        if (!ours(i) || imported.hasShare(mine)) continue;
+        const auto row{std::find_if(rows.begin(), rows.end(), [&](const auto& s) { return s.label == mine.label; })};
+        const bool owner_elsewhere{
+            std::any_of(rows.begin(), rows.end(), [&](const auto& s) { return s.ownerAddress == mine.ownerAddress; })};
+        if (row == rows.end() || owner_elsewhere || !row->ownerAddress.isEmpty() || !row->refundAddress.isEmpty() ||
+            !row->rewardAddress.isEmpty()) {
+            continue;
+        }
+        row->ownerAddress = mine.ownerAddress;
+        row->refundAddress = mine.refundAddress;
+        row->rewardAddress = mine.rewardAddress;
+    }
+
+    const auto refuse = [&](int share) {
+        showError(tr("This newer invitation changes your share (%1), so it was not loaded. If you agreed to that "
+                     "change, close this window and open the new invitation to review it. Otherwise ask %2 to send an "
+                     "invitation with your share unchanged.")
+                      .arg(ShareName(m_session, share), recipientName()));
+    };
+    if (const int changed{ownShareChangedIn(revised)}; changed >= 0) {
+        refuse(changed);
+        return;
+    }
+    // Contributions are found by the share's name, so a renamed row, or a
+    // second contribution under the same name, would let the invitation's
+    // coins stand in for the ones this wallet reserved
+    const auto& contributions{m_session.contributions()};
+    for (size_t i = 0; i < shares.size(); ++i) {
+        if (!ours(i)) continue;
+        const QString& label{shares[i].label};
+        const bool renamed{std::any_of(rows.begin(), rows.end(), [&](const auto& s) {
+            return s.ownerAddress == shares[i].ownerAddress && s.label != label;
+        })};
+        const bool name_reused{std::count_if(rows.begin(), rows.end(), [&](const auto& s) { return s.label == label; }) !=
+                               1};
+        const auto mine{
+            std::find_if(contributions.begin(), contributions.end(), [&](const auto& c) { return c.label == label; })};
+        const auto listed{std::count_if(revised.contributions().begin(), revised.contributions().end(),
+                                        [&](const auto& c) { return c.label == label; })};
+        bool kept{false};
+        if (mine == contributions.end()) {
+            kept = listed == 0;
+        } else if (listed == 1) {
+            kept = revised.hasContribution(*mine);
+        } else if (listed == 0) {
+            QString error;
+            kept = revised.addContribution(*mine, error);
+        }
+        if (renamed || name_reused || !kept) {
+            refuse(static_cast<int>(i));
+            return;
+        }
+    }
+    // Loading picks this wallet's share again by owner address, so another row
+    // given an address from this wallet would take the place of the one it sent
+    if (m_my_share >= 0 && ours(m_my_share)) {
+        for (size_t i = 0; i < rows.size(); ++i) {
+            const CTxDestination owner{DecodeDestination(rows[i].ownerAddress.toStdString())};
+            if (!std::holds_alternative<PKHash>(owner) || !m_wallet_model->wallet().isSpendable(owner)) continue;
+            if (std::any_of(shares.begin(), shares.end(),
+                            [&](const auto& s) { return s.ownerAddress == rows[i].ownerAddress; })) {
+                continue;
+            }
+            showError(tr("This newer invitation gives %1's share an owner address from this wallet, so it was not "
+                         "loaded. Ask %2 to send an invitation in which only your own share uses this wallet's "
+                         "addresses.")
+                          .arg(ShareName(revised, static_cast<int>(i)), recipientName()));
+            return;
+        }
+    }
+    // Loading a session with a spent coin in it would release this wallet's
+    // reservation and leave nothing to reply to
+    if (const QString dead{deadReason(revised)}; !dead.isEmpty()) {
+        showError(dead);
+        return;
+    }
+
+    // Several rows can have an owner from this wallet, for one it released, so
+    // the row selected here stays this wallet's share rather than the first
+    int selected{-1};
+    if (m_my_share >= 0 && static_cast<size_t>(m_my_share) < shares.size()) {
+        const auto& chosen{shares[m_my_share]};
+        const auto row{std::find_if(rows.begin(), rows.end(), [&](const auto& s) {
+            return s.label == chosen.label && s.ownerAddress == chosen.ownerAddress;
+        })};
+        if (row != rows.end()) selected = static_cast<int>(std::distance(rows.begin(), row));
+    }
+    replaceSession(revised, selected);
+    // Re-adding this wallet's coins moved the revision on from the invitation's
+    m_invitation_revision = imported.revision();
+    m_dirty = true;
+    showStatus(tr("Loaded the newer invitation; your share is unchanged. Review it, then send your details again."));
+}
+
 void SharedMnCreateDialog::absorbSession(const MnShareSession& imported)
 {
     const MnShareSession before{m_session};
@@ -2985,6 +3242,19 @@ void SharedMnCreateDialog::absorbSession(const MnShareSession& imported)
 
     if (m_session.stage() == MnShareSession::Stage::Draft &&
         imported.stage() == MnShareSession::Stage::Draft) {
+        // A participant is sent the coordinator's edited draft, not a reply: a
+        // copy that is more than this one filled in is a newer invitation
+        if (m_role == Role::Participant && imported.sessionId() == m_session.sessionId() &&
+            MnShareSession{m_session}.absorbDraftReply(imported, error) != MnShareSession::MergeResult::Merged) {
+            if (imported.revision() < m_invitation_revision) {
+                showError(tr("This invitation is older than the one you already have, so it was not loaded. Ask %1 "
+                             "for the latest invitation.")
+                              .arg(recipientName()));
+                return;
+            }
+            followNewerInvitation(imported);
+            return;
+        }
         // A reply to this exact invitation: only ever fills empty rows in, so
         // replies can be pasted in any order.
         absorbed = m_session.absorbDraftReply(imported, error) == MnShareSession::MergeResult::Merged;
@@ -2992,6 +3262,24 @@ void SharedMnCreateDialog::absorbSession(const MnShareSession& imported)
             showError(error);
             return;
         }
+        // A reply to an invitation sent before this wallet released its coins
+        // still carries that contribution, which only Reserve may put back
+        for (const auto& released : m_released_contributions) {
+            const auto& merged{m_session.contributions()};
+            const auto back{std::find_if(merged.begin(), merged.end(), [&](const MnShareSession::Contribution& c) {
+                return SpendsReleasedCoins(c, released);
+            })};
+            if (back == merged.end()) continue;
+            const auto& prior{before.contributions()};
+            if (std::any_of(prior.begin(), prior.end(), [&](const auto& c) { return c.label == back->label; })) {
+                continue;
+            }
+            if (const QString label{back->label}; !m_session.removeContribution(label, error)) {
+                m_session = before;
+                showError(error);
+                return;
+            }
+        }
         m_replies_absorbed_revision = m_session.revision();
     } else if (m_session.stage() == MnShareSession::Stage::Draft) {
         absorbed = m_session.adoptLockedTerms(imported, error);
@@ -3010,6 +3298,16 @@ void SharedMnCreateDialog::absorbSession(const MnShareSession& imported)
                           .arg(imported.fingerprint(), m_session.fingerprint()));
             return;
         case MnShareSession::MergeResult::OtherNewer:
+            // A newer copy may change other rows and the funding, but not the
+            // amount or addresses of a share this wallet holds
+            if (const int changed{ownShareChangedIn(imported)}; changed >= 0) {
+                showError(tr("This newer copy changes your share (%1), so it was not loaded. If you agreed to "
+                             "that change, close this window and open the copy again to review it. Otherwise ask %2 "
+                             "to send a copy with your share unchanged.")
+                              .arg(ShareName(m_session, changed),
+                                   m_role == Role::Coordinator ? tr("whoever sent it") : recipientName()));
+                return;
+            }
             replaceSession(imported);
             return;
         case MnShareSession::MergeResult::Conflict:
@@ -3162,6 +3460,10 @@ void SharedMnCreateDialog::reserveCoins()
         showError(tr("Enter a valid refund address (P2PKH or P2SH)."));
         return;
     }
+    if (QString problem; !validatePage(PageContribution, problem)) {
+        showError(problem);
+        return;
+    }
 
     QString error;
     auto& share{m_session.shares()[m_my_share]};
@@ -3196,6 +3498,14 @@ void SharedMnCreateDialog::reserveCoins()
         return;
     }
     setContributionLocked(contribution, /*lock=*/true);
+    m_coins_released = false;
+    // Coins reserved again are no longer released
+    for (auto& released : m_released_contributions) {
+        std::erase_if(released.inputs, [&](const MnShareSession::Input& input) {
+            return ContributesOutpoint(contribution.inputs, COutPoint(uint256S(input.txid.toStdString()), input.vout));
+        });
+    }
+    std::erase_if(m_released_contributions, [](const auto& released) { return released.inputs.empty(); });
     m_dirty = true;
     // The coins card now leads with "Reserved - ..." and the Reserve button has
     // become Release; repeating the same sentence under the page says it twice
@@ -3214,6 +3524,8 @@ void SharedMnCreateDialog::releaseCoins()
         return;
     }
     setContributionLocked(removed, /*lock=*/false);
+    m_coins_released = true;
+    m_released_contributions.push_back(removed);
     m_dirty = true;
     refreshAll();
 }
@@ -3233,6 +3545,7 @@ void SharedMnCreateDialog::releaseReservedCoins()
     box.exec();
     if (box.clickedButton() != release) return;
     unlockAllContributedCoins();
+    m_coins_released = true;
     refreshAll();
     showStatus(tr("Released — these coins can be spent again."));
 }
@@ -3242,7 +3555,11 @@ bool SharedMnCreateDialog::hasLockedContributedCoins() const
     if (m_wallet_model == nullptr) return false;
     for (const auto& contribution : m_session.contributions()) {
         for (const auto& input : contribution.inputs) {
-            if (m_wallet_model->wallet().isLockedCoin(COutPoint(uint256S(input.txid.toStdString()), input.vout))) {
+            const COutPoint outpoint{uint256S(input.txid.toStdString()), input.vout};
+            if (!m_wallet_model->wallet().isLockedCoin(outpoint)) continue;
+            const auto known{m_wallet_model->wallet().getCoins({outpoint})};
+            if (!known.empty() && known.front().depth_in_main_chain >= 0 && !known.front().is_spent &&
+                m_wallet_model->wallet().isSpendable(known.front().txout.scriptPubKey)) {
                 return true;
             }
         }
@@ -3259,6 +3576,7 @@ void SharedMnCreateDialog::refreshContributedCoinLocks()
         unlockAllContributedCoins();
         return;
     }
+    if (m_coins_released) return;
     lockKnownContributedCoins();
 }
 
@@ -3290,16 +3608,33 @@ void SharedMnCreateDialog::lockKnownContributedCoins()
             const COutPoint outpoint{uint256S(input.txid.toStdString()), input.vout};
             const auto known{m_wallet_model->wallet().getCoins({outpoint})};
             if (known.empty() || known.front().depth_in_main_chain < 0 || known.front().is_spent) continue;
+            // A transaction this wallet knows can pay other participants too,
+            // and a lock on their coin is one Coin Control cannot release
+            if (!m_wallet_model->wallet().isSpendable(known.front().txout.scriptPubKey)) continue;
             m_wallet_model->wallet().lockCoin(outpoint, /*write_to_db=*/true);
         }
     }
 }
 
-void SharedMnCreateDialog::checkSessionLiveness()
+void SharedMnCreateDialog::checkSessionLiveness() { m_dead_reason = deadReason(m_session); }
+
+QString SharedMnCreateDialog::deadReason(const MnShareSession& session) const
 {
-    m_dead_reason.clear();
-    if (m_wallet_model == nullptr || m_session.stage() == MnShareSession::Stage::Broadcast) return;
-    for (const auto& contribution : m_session.contributions()) {
+    if (m_wallet_model == nullptr || session.stage() == MnShareSession::Stage::Broadcast) return {};
+    // Once broadcast, the registration itself is what spends every funding
+    // coin, unless it lost to another spend or was abandoned
+    if (CMutableTransaction funding; session.stage() == MnShareSession::Stage::FundingSigned &&
+                                     DecodeHexTx(funding, session.protxHex().toStdString())) {
+        interfaces::WalletTxStatus status;
+        interfaces::WalletOrderForm order_form;
+        bool in_mempool{false};
+        int num_blocks{0};
+        const interfaces::WalletTx registration{
+            m_wallet_model->wallet().getWalletTxDetails(CTransaction(funding).GetHash(), status, order_form, in_mempool,
+                                                        num_blocks)};
+        if (registration.tx != nullptr && status.depth_in_main_chain >= 0 && !status.is_abandoned) return {};
+    }
+    for (const auto& contribution : session.contributions()) {
         for (const auto& input : contribution.inputs) {
             const COutPoint outpoint{uint256S(input.txid.toStdString()), input.vout};
             Coin coin;
@@ -3310,11 +3645,11 @@ void SharedMnCreateDialog::checkSessionLiveness()
             // the recorded funding transaction can never confirm.
             const auto known{m_wallet_model->wallet().getCoins({outpoint})};
             if (known.empty() || known.front().depth_in_main_chain < 0 || !known.front().is_spent) continue;
-            m_dead_reason = tr("A coin reserved for this session was spent. The registration can no longer be "
-                               "completed — start over.");
-            return;
+            return tr("A coin reserved for this session was spent. The registration can no longer be completed — "
+                      "start over.");
         }
     }
+    return {};
 }
 
 const MnShareSession::Contribution* SharedMnCreateDialog::myContribution() const
@@ -3450,6 +3785,16 @@ void SharedMnCreateDialog::inferMyShare()
     m_my_share = candidate;
 }
 
+int SharedMnCreateDialog::ownShareChangedIn(const MnShareSession& imported) const
+{
+    const auto& shares{m_session.shares()};
+    for (size_t i = 0; i < shares.size(); ++i) {
+        const bool ours{!shares[i].ownerAddress.isEmpty() && !shareTakenByOther(i)};
+        if (ours && !imported.hasShare(shares[i])) return static_cast<int>(i);
+    }
+    return -1;
+}
+
 bool SharedMnCreateDialog::shareTakenByOther(size_t index) const
 {
     const auto& shares{m_session.shares()};
@@ -3590,7 +3935,9 @@ bool SharedMnCreateDialog::allFundingSigned() const
 void SharedMnCreateDialog::reject()
 {
     if (m_busy) return;
-    if (m_finished || m_role == Role::Undecided || !m_dirty) {
+    // A session opened from a file is unchanged, but the coins it reserves
+    // stay locked after the dialog closes all the same
+    if (m_finished || m_role == Role::Undecided || (!m_dirty && !hasLockedContributedCoins())) {
         QDialog::reject();
         return;
     }
@@ -3619,8 +3966,7 @@ void SharedMnCreateDialog::reject()
             goToPage(PageSecret);
             return;
         }
-        saveSession();
-        if (m_dirty) return; // the save was cancelled
+        if (!saveSession()) return;
     } else if (box.clickedButton() == discard) {
         if (m_session.stage() != MnShareSession::Stage::Broadcast) unlockAllContributedCoins();
     } else {
diff --git a/src/qt/sharedmncreatedialog.h b/src/qt/sharedmncreatedialog.h
index 65faebdae3a8..9a33083524a1 100644
--- a/src/qt/sharedmncreatedialog.h
+++ b/src/qt/sharedmncreatedialog.h
@@ -261,10 +261,17 @@ private Q_SLOTS:
     //! Who the current message goes to
     QString recipientName() const;
     void copySession(const QString& what);
-    void saveSession();
+    //! False when nothing was saved: the file dialog was cancelled, the file
+    //! could not be written, or the operator key still has to be saved
+    bool saveSession();
     void handleImportedText(const QString& text);
     void absorbSession(const MnShareSession& imported);
-    void replaceSession(const MnShareSession& imported);
+    //! Load `imported` in place of the session, answering for row `my_share`
+    //! when it is still this wallet's, or for the row it infers otherwise
+    void replaceSession(const MnShareSession& imported, int my_share = -1);
+    //! A participant's answer to a newer draft invitation: load it when every
+    //! share this wallet holds comes back as sent or still unanswered
+    void followNewerInvitation(const MnShareSession& imported);
 
     // Funding
     //! Confirmed, unlocked, spendable wallet coins covering `target`, largest
@@ -280,18 +287,23 @@ private Q_SLOTS:
     //! first: if the coins are then spent, nobody can complete the
     //! registration.
     void releaseReservedCoins();
-    //! True when at least one coin this wallet contributed is still locked in
-    //! it, i.e. there is something for "Release my coins" to do
+    //! True when at least one of this wallet's own coins among the session's
+    //! inputs is still locked in it, i.e. there is something for "Release my
+    //! coins" to do
     bool hasLockedContributedCoins() const;
     //! Lock the coins of a session in progress, or unlock them once it is
     //! broadcast and they are spent
     void refreshContributedCoinLocks();
     void setContributionLocked(const MnShareSession::Contribution& contribution, bool lock);
     void unlockAllContributedCoins();
+    //! Lock the session's unspent inputs that this wallet can spend
     void lockKnownContributedCoins();
     //! Re-check that every funding coin this wallet contributed is still
     //! unspent, and set m_dead_reason when one is gone
     void checkSessionLiveness();
+    //! Why `session` can never complete because a coin this wallet tracks in
+    //! it was spent, or empty
+    QString deadReason(const MnShareSession& session) const;
     //! Contribution recorded for the share this wallet holds, or nullptr
     const MnShareSession::Contribution* myContribution() const;
     //! Value of a recorded funding input: this wallet's own view for the coins
@@ -324,6 +336,8 @@ private Q_SLOTS:
     //! True when share `index` names an owner address this wallet cannot
     //! spend, so another participant holds it
     bool shareTakenByOther(size_t index) const;
+    //! The first share this wallet holds that `imported` changes or drops, or -1
+    int ownShareChangedIn(const MnShareSession& imported) const;
     //! Put the addresses recorded for the share this wallet holds into the
     //! contribution page, replacing any left over from another share
     void loadMyShareAddresses();
@@ -387,6 +401,14 @@ private Q_SLOTS:
     bool m_updating{false}; //!< guards widget refresh against change signals
     bool m_lock_confirming{false};
     bool m_finished{false};
+    //! The user released this wallet's coins with "Release" or "Release my
+    //! coins", and a later copy of the session must not lock them again until
+    //! the user reserves or signs them
+    bool m_coins_released{false};
+    //! Contributions the user withdrew with "Release" on the contribution page,
+    //! less any coins reserved again since. A reply to an earlier invitation
+    //! still carries them, and only Reserve may put them back.
+    std::vector<MnShareSession::Contribution> m_released_contributions;
     Role m_role{Role::Undecided};
     int m_my_share{-1};
     std::optional<Page> m_validation_page;
@@ -405,6 +427,10 @@ private Q_SLOTS:
     //! coordinator edited the draft after somebody had already answered it,
     //! which is the only case where the replies really are stale.
     int m_replies_absorbed_revision{-1};
+    //! Revision of the coordinator's invitation a participant last loaded, or -1
+    //! when unknown. Reserving coins bumps the participant's own revision as
+    //! well, so only this tells an older invitation from a newer one.
+    int m_invitation_revision{-1};
     //! A recorded funding coin was spent, so the registration can never
     //! complete
     QString m_dead_reason;
@@ -465,6 +491,7 @@ private Q_SLOTS:
     QValidatedLineEdit* m_owner_edit{nullptr};
     QValidatedLineEdit* m_refund_edit{nullptr};
     QValidatedLineEdit* m_reward_edit{nullptr};
+    QVector<QPushButton*> m_new_address_buttons;
     QWidget* m_fee_box{nullptr};
     BitcoinAmountField* m_fee_field{nullptr};
     QLabel* m_coins_label{nullptr};
@@ -490,6 +517,7 @@ private Q_SLOTS:
     QLabel* m_approvals_terms{nullptr};
     QPushButton* m_copy_terms_button{nullptr};
     QPushButton* m_unlock_button{nullptr};
+    QPushButton* m_approvals_release_button{nullptr};
     QLabel* m_prepare_warning_label{nullptr};
 
     // Signatures / Sign contribution
@@ -499,6 +527,7 @@ private Q_SLOTS:
     QLabel* m_signatures_unchanged{nullptr};
     QLabel* m_signatures_terms{nullptr};
     QPushButton* m_copy_signing_button{nullptr};
+    QPushButton* m_signatures_release_button{nullptr};
 
     // Waiting pages
     struct WaitingPage {
diff --git a/src/qt/sharedmndialogs.cpp b/src/qt/sharedmndialogs.cpp
index c68f9e7e75c8..c2b02bcd5241 100644
--- a/src/qt/sharedmndialogs.cpp
+++ b/src/qt/sharedmndialogs.cpp
@@ -761,7 +761,9 @@ void SharedSigCollector::pasteEnvelope()
     // Same cap as loadEnvelope(): a request is a few kilobytes and parsing
     // happens on the GUI thread
     if (text.toUtf8().size() > MAX_ENVELOPE_FILE_BYTES) {
-        showStatus(tr("That message is too large to be a shared masternode message."), /*error=*/true);
+        const QString error{tr("That message is too large to be a shared masternode message.")};
+        showStatus(error, /*error=*/true);
+        Q_EMIT imported(/*accepted=*/false, error);
         return;
     }
     importAndReport(text);
@@ -773,6 +775,7 @@ void SharedSigCollector::importAndReport(const QString& text)
     QString error;
     const bool ok{importEnvelope(text, error)};
     showStatus(error, /*error=*/!ok || !error.isEmpty());
+    Q_EMIT imported(ok, error);
     if (!ok) return;
     UniValue json;
     if (!json.read(text.trimmed().toStdString())) return;
@@ -792,7 +795,9 @@ void SharedSigCollector::loadEnvelope()
     if (filename.isEmpty()) return;
     QFile file(filename);
     if (!file.open(QIODevice::ReadOnly) || file.size() > MAX_ENVELOPE_FILE_BYTES) {
-        showStatus(tr("Could not read %1.").arg(filename), /*error=*/true);
+        const QString error{tr("Could not read %1.").arg(filename)};
+        showStatus(error, /*error=*/true);
+        Q_EMIT imported(/*accepted=*/false, error);
         return;
     }
     const QString text{QString::fromUtf8(file.readAll())};
@@ -1166,7 +1171,10 @@ QWidget* DissolveDialog::buildNowTab()
 
     m_now_fee = makeFeeField(tab);
     m_now_fee->setToolTip(tr("Transaction fee, paid from your share's refund."));
-    connect(m_now_fee, &BitcoinAmountField::valueChanged, this, &DissolveDialog::updateNowPreview);
+    // Follow the editor's text rather than valueChanged: the field clamps an
+    // out-of-range fee on focus-out without emitting valueChanged, and the
+    // preview must show the fee that is actually sent
+    connect(m_now_fee->findChild<QLineEdit*>(), &QLineEdit::textChanged, this, &DissolveDialog::updateNowPreview);
     form->addRow(tr("Fee:"), m_now_fee);
     layout->addLayout(form);
 
@@ -1405,6 +1413,7 @@ QWidget* DissolveDialog::buildTogetherTab()
     m_un_collector = new SharedSigCollector(SharedSigCollector::Kind::Dissolve, m_protx_hash, m_shares, m_wallet_model,
                                             approvals_card);
     connect(m_un_collector, &SharedSigCollector::changed, this, &DissolveDialog::refreshTogetherUi);
+    connect(m_un_collector, &SharedSigCollector::imported, this, &DissolveDialog::togetherImported);
     approvals_layout->addWidget(m_un_collector);
 
     m_un_approve = new QPushButton(tr("Approve and Copy Reply"), approvals_card);
@@ -1490,10 +1499,11 @@ void DissolveDialog::refreshTogetherUi()
         if (m_un_actor->count() == 0) m_un_prepare->setToolTip(NoShareKeysMessage());
     }
     if (gateButton(m_un_approve)) {
-        m_un_approve->setEnabled(alive && has_tx && holdsAnyShareKey() && !m_un_collector->complete());
+        m_un_approve->setEnabled(alive && has_tx && holdsAnyShareKey() && !m_un_collector->complete() && !m_un_refused);
         m_un_approve->setToolTip(!holdsAnyShareKey() ? NoShareKeysMessage()
-                                : !has_tx           ? tr("Prepare or paste a request first.")
-                                                    : QString{});
+                                 : !has_tx           ? tr("Prepare or paste a request first.")
+                                 : m_un_refused      ? tr("This dissolution cannot be approved.")
+                                                     : QString{});
     }
     if (gateButton(m_un_send)) {
         m_un_send->setEnabled(alive && m_un_collector->complete());
@@ -1505,6 +1515,16 @@ void DissolveDialog::refreshTogetherUi()
                              .arg(m_shares.size()));
 }
 
+void DissolveDialog::togetherImported(bool accepted, const QString& error)
+{
+    m_un_refused = !accepted;
+    if (m_un_refused) {
+        m_un_collector->showStatus(error + QLatin1Char('\n') + tr("This dissolution cannot be approved."),
+                                   /*error=*/true);
+    }
+    refreshTogetherUi();
+}
+
 void DissolveDialog::prepareTogether()
 {
     if (m_un_actor->currentIndex() < 0) return;
@@ -1518,6 +1538,10 @@ void DissolveDialog::prepareTogether()
         [this](MasternodeOperationRunner::SharedConsentResult result) {
             const auto* prepared{ValueOrReport(result, m_un_status)};
             if (prepared == nullptr || !adoptPreparedTx(m_un_collector, *prepared, m_un_status)) return;
+            if (m_un_refused) {
+                m_un_refused = false;
+                m_un_collector->showStatus(QString{}, /*error=*/false);
+            }
             m_un_fee->setEnabled(false);
             m_un_actor->setEnabled(false);
             m_un_prepare->setEnabled(false);
@@ -1530,6 +1554,7 @@ void DissolveDialog::prepareTogether()
 
 void DissolveDialog::approveTogether()
 {
+    if (m_un_refused) return;
     signWithWallet(m_un_collector, m_un_status, [this](bool absorbed) {
         if (!absorbed) return;
         m_un_collector->copyEnvelope();
diff --git a/src/qt/sharedmndialogs.h b/src/qt/sharedmndialogs.h
index cd06b099f951..a39536f6f846 100644
--- a/src/qt/sharedmndialogs.h
+++ b/src/qt/sharedmndialogs.h
@@ -126,10 +126,16 @@ class SharedSigCollector : public QWidget
     std::vector<interfaces::SharedSignature> signatures() const;
     //! The adopted transaction, or null when there is none
     CTransactionRef transaction() const;
+    //! Replace the status line under the buttons
+    void showStatus(const QString& message, bool error);
 
 Q_SIGNALS:
     //! The transaction or the signature set changed
     void changed();
+    //! A pasted or opened message was imported (`accepted`) or refused,
+    //! including one too large or unreadable to parse; `error` is the text
+    //! already shown in the status line
+    void imported(bool accepted, const QString& error);
 
 private Q_SLOTS:
     void saveEnvelope();
@@ -143,7 +149,6 @@ private Q_SLOTS:
     void showCodeLine(const QString& text);
     bool importEnvelopeChecked(const UniValue& json, QString& error);
     void refreshUi();
-    void showStatus(const QString& message, bool error);
 
     const Kind m_kind;
     const QString m_protx_hash;
@@ -313,6 +318,7 @@ private Q_SLOTS:
     //! stop warning about it
     void recordStandbySaved();
     void refreshTogetherUi();
+    void togetherImported(bool accepted, const QString& error);
 
     //! Height captured at dialog open, refreshed from the tip in submitNow()
     int m_current_height;
@@ -341,6 +347,10 @@ private Q_SLOTS:
     QPushButton* m_un_approve{nullptr};
     QPushButton* m_un_send{nullptr};
     QLabel* m_un_reason{nullptr};
+    //! The last message pasted or opened on the Together tab was refused.
+    //! Approving would sign the request loaded before it, not the refused one,
+    //! so approving stays blocked until a message is accepted again.
+    bool m_un_refused{false};
     //! What the adopted request actually pays out, so nobody approves a
     //! transaction on the strength of its title alone
     QLabel* m_un_payouts_title{nullptr};
diff --git a/src/qt/sharedmnwidgets.cpp b/src/qt/sharedmnwidgets.cpp
index c688dfcab0f9..f459f7d50e39 100644
--- a/src/qt/sharedmnwidgets.cpp
+++ b/src/qt/sharedmnwidgets.cpp
@@ -102,8 +102,9 @@ QString SharedMnBroadcast(interfaces::Node& node, const CTransactionRef& tx)
     const TransactionError error{
         node.broadcastTransaction(tx, node::DEFAULT_MAX_RAW_TX_FEE_RATE.GetFee(GetVirtualTransactionSize(*tx)), message)};
     if (error == TransactionError::OK) return {};
-    if (message.empty()) message = TransactionErrorString(error);
-    return MasternodeOperationRunner::errorText({interfaces::ProviderTxErrorCode::BROADCAST_ERROR, message, {}, error});
+    // BroadcastTransaction() reports a mempool rejection only in message.original
+    return MasternodeOperationRunner::errorText(
+        {interfaces::ProviderTxErrorCode::BROADCAST_ERROR, TransactionErrorString(error), message.original, error});
 }
 
 SharedMnStatusBoard::SharedMnStatusBoard(QWidget* parent) : QWidget(parent)
diff --git a/src/qt/test/masternodemaintenancetests.cpp b/src/qt/test/masternodemaintenancetests.cpp
index 49b7d508483d..b81d13c1af40 100644
--- a/src/qt/test/masternodemaintenancetests.cpp
+++ b/src/qt/test/masternodemaintenancetests.cpp
@@ -40,24 +40,29 @@
 #include <wallet/wallet.h>
 
 #include <QApplication>
+#include <QClipboard>
 #include <QComboBox>
 #include <QDir>
 #include <QFile>
+#include <QFocusEvent>
 #include <QLabel>
 #include <QLineEdit>
 #include <QMessageBox>
 #include <QPushButton>
 #include <QSignalSpy>
 #include <QSpinBox>
-#include <QTableWidget>
 #include <QTabWidget>
+#include <QTableWidget>
 #include <QTemporaryDir>
 #include <QTest>
 #include <QTimer>
 
+#include <chrono>
+#include <future>
 #include <limits>
 #include <memory>
 #include <string>
+#include <thread>
 #include <utility>
 
 using wallet::WalletContext;
@@ -223,7 +228,7 @@ class TestMnEntry final : public interfaces::MnEntry
     std::string m_operator_display;
     std::string m_core_endpoint;
     std::string m_platform_p2p{"127.0.0.1:26656"};
-    std::string m_platform_https{"api.example.com:443"};
+    std::string m_platform_https{"127.0.0.1:443"};
     std::string m_platform_node_id{"1111111111111111111111111111111111111111"};
 };
 
@@ -236,6 +241,65 @@ void MasternodeMaintenanceTests::automaticFeeSource()
     QCOMPARE(picker.count(), 1);
     QCOMPARE(picker.currentText(), QString("Automatic (recommended)"));
     QVERIFY(picker.selectedAddress().isEmpty());
+
+    // A wallet funded at an address that is neither a payout nor a share
+    // reward address of the masternode, like a hosting operator's
+    TestChain100Setup test;
+    m_node.setContext(&test.m_node);
+    WalletContext& context{*m_node.walletLoader().context()};
+    const auto wallet{MakeTestWallet(m_node, context, "operator")};
+    QVERIFY(wallet != nullptr);
+    WalletGuard guard{context, wallet};
+    CTxDestination funded;
+    {
+        LOCK(wallet->cs_wallet);
+        const auto destination{wallet->GetNewDestination("")};
+        QVERIFY(destination);
+        funded = *destination;
+        const CBlockIndex* tip{
+            WITH_LOCK(test.m_node.chainman->GetMutex(), return test.m_node.chainman->ActiveChain().Tip())};
+        wallet->SetLastBlockProcessed(tip->nHeight, tip->GetBlockHash());
+        CMutableTransaction funding;
+        funding.vin.emplace_back(GetRandHash(), 0);
+        funding.vout.emplace_back(10 * COIN, GetScriptForDestination(funded));
+        QVERIFY(wallet->AddToWallet(MakeTransactionRef(funding),
+                                    wallet::TxStateConfirmed{tip->GetBlockHash(), tip->nHeight, /*index=*/0}) != nullptr);
+    }
+    MasternodeTestUtil::GuiModels models{m_node};
+    QVERIFY2(models.ok, qPrintable(QString::fromStdString(models.error.translated)));
+    WalletModel wallet_model(interfaces::MakeWallet(context, wallet), models.client);
+    const interfaces::ProviderTxCapabilities capabilities{ProTxVersion::BasicBLS, false};
+
+    // A regular masternode's dialogs leave the fee source to Core
+    auto regular{std::make_shared<TestMnEntry>(MnType::Regular)};
+    MasternodeEntry regular_entry{regular, "collateral", 50};
+    UpdateServiceDialog regular_service(m_node, &wallet_model, regular_entry, capabilities, /*parent=*/nullptr);
+    QCOMPARE(regular_service.m_fee_source->currentText(), QString("Automatic (recommended)"));
+    QString error;
+    const auto regular_update{regular_service.buildRequest(regular->operatorSecret(), error)};
+    QVERIFY2(regular_update.has_value(), qPrintable(error));
+    QVERIFY(!regular_update->fee_source.has_value());
+    RevokeDialog regular_revoke(m_node, &wallet_model, regular_entry, /*parent=*/nullptr);
+    QCOMPARE(regular_revoke.m_fee_source->currentText(), QString("Automatic (recommended)"));
+    const auto regular_revocation{regular_revoke.buildRequest(regular->operatorSecret(), error)};
+    QVERIFY2(regular_revocation.has_value(), qPrintable(error));
+    QVERIFY(!regular_revocation->fee_source.has_value());
+
+    // Core's automatic choice for a shared masternode is the first share's
+    // reward address, which this wallet does not own: pay from this wallet
+    auto shared{std::make_shared<TestMnEntry>(MnType::Regular)};
+    shared->makeShared({400 * COIN, 300 * COIN, 300 * COIN}, 5 * COIN, /*early_period_blocks=*/1000);
+    MasternodeEntry shared_entry{shared, "collateral", 50};
+    UpdateServiceDialog shared_service(m_node, &wallet_model, shared_entry, capabilities, /*parent=*/nullptr);
+    QCOMPARE(shared_service.m_fee_source->findText("Automatic (recommended)"), -1);
+    const auto shared_update{shared_service.buildRequest(shared->operatorSecret(), error)};
+    QVERIFY2(shared_update.has_value(), qPrintable(error));
+    QVERIFY(shared_update->fee_source == std::optional<CTxDestination>{funded});
+    RevokeDialog shared_revoke(m_node, &wallet_model, shared_entry, /*parent=*/nullptr);
+    QCOMPARE(shared_revoke.m_fee_source->findText("Automatic (recommended)"), -1);
+    const auto shared_revocation{shared_revoke.buildRequest(shared->operatorSecret(), error)};
+    QVERIFY2(shared_revocation.has_value(), qPrintable(error));
+    QVERIFY(shared_revocation->fee_source == std::optional<CTxDestination>{funded});
 }
 
 void MasternodeMaintenanceTests::operatorSecretValidation()
@@ -372,7 +436,7 @@ void MasternodeMaintenanceTests::serviceRequestConstruction()
             QCOMPARE(std::get<std::vector<std::string>>(request->net_info.platform_p2p),
                      std::vector<std::string>{"127.0.0.1:26656"});
             QCOMPARE(std::get<std::vector<std::string>>(request->net_info.platform_https),
-                     std::vector<std::string>{"api.example.com:443"});
+                     std::vector<std::string>{"127.0.0.1:443"});
             QVERIFY(request->platform_node_id.has_value());
         } else {
             QCOMPARE(std::get<uint16_t>(request->net_info.platform_p2p), uint16_t{26656});
@@ -398,6 +462,33 @@ void MasternodeMaintenanceTests::serviceRequestConstruction()
     check_request(MnType::Evo, {ProTxVersion::BasicBLS, false});
     check_request(MnType::Evo, {ProTxVersion::ExtAddr, true});
 
+    // The dialog validates against its capability snapshot, without waiting for cs_main while the user types
+    auto other_host{std::make_shared<TestMnEntry>(MnType::Evo)};
+    other_host->setPlatformEndpoints("127.0.0.2:26656", "127.0.0.2:443");
+    const MasternodeEntry other_host_entry{other_host, "collateral", 50};
+    for (const bool ipv4_optional : {false, true}) {
+        UpdateServiceDialog dialog(m_node, /*wallet_model=*/nullptr, other_host_entry,
+                                   interfaces::ProviderTxCapabilities{ProTxVersion::ExtAddr, true, ipv4_optional},
+                                   /*parent=*/nullptr);
+        QString error;
+        QCOMPARE(dialog.buildRequest(other_host->operatorSecret(), error).has_value(), ipv4_optional);
+        QVERIFY2(ipv4_optional || error.contains("bad-protx-netinfo-addr"), qPrintable(error));
+
+        std::promise<void> locked;
+        std::promise<void> release;
+        bool lock_timed_out{false};
+        std::thread holder{[&] {
+            LOCK(::cs_main);
+            locked.set_value();
+            lock_timed_out = release.get_future().wait_for(std::chrono::seconds{10}) == std::future_status::timeout;
+        }};
+        locked.get_future().wait();
+        dialog.m_platform_p2p_edit->setText("127.0.0.1:26656");
+        release.set_value();
+        holder.join();
+        QVERIFY(!lock_timed_out);
+    }
+
     auto malformed_source{std::make_shared<TestMnEntry>(MnType::Evo)};
     malformed_source->setPlatformEndpoints("missing-port", "api.example.com:not-a-port");
     MasternodeEntry malformed_entry{malformed_source, "collateral", 50};
@@ -776,6 +867,23 @@ void MasternodeMaintenanceTests::dissolveDialogTabsAndPayouts()
     QVERIFY(preview.payouts[0] < amounts[0]);
     QVERIFY(preview.payouts[1] > amounts[1]);
     QVERIFY(preview.payouts[2] > amounts[2]);
+
+    // A typed fee outside the allowed range is clamped when the field loses
+    // focus, and the preview follows the fee that will actually be sent
+    auto* fee_edit{dialog.m_now_fee->findChild<QLineEdit*>()};
+    QVERIFY(fee_edit != nullptr);
+    for (const auto& [typed, clamped] : {std::pair{"0.5", CProDisTx::MAX_FEE}, std::pair{"0.000005", CAmount{1000}}}) {
+        fee_edit->clear();
+        QTest::keyClicks(fee_edit, typed);
+        QFocusEvent focus_out{QEvent::FocusOut};
+        QApplication::sendEvent(fee_edit, &focus_out);
+        QCOMPARE(dialog.m_now_fee->value(), clamped);
+        const auto clamped_preview{MnShareSession::PenaltyPreviewFor(amounts, /*actor_index=*/0, 5 * COIN,
+                                                                     /*early_period_blocks=*/1000, clamped,
+                                                                     /*at_height=*/100, /*registered_height=*/1)};
+        QCOMPARE(dialog.m_now_table->item(0, 2)->text(),
+                 SharedMnFormatAmount(BitcoinUnits::Unit::DASH, clamped_preview.payouts[0]));
+    }
 }
 
 void MasternodeMaintenanceTests::standbyDissolutionFile()
@@ -921,13 +1029,22 @@ void MasternodeMaintenanceTests::dissolveRequestMustReturnPrincipal()
 {
     TestChain100Setup test;
     m_node.setContext(&test.m_node);
+    WalletContext& context{*m_node.walletLoader().context()};
+    const auto wallet{MakeCoinbaseWallet(m_node, context, test, "approver", /*encrypt=*/false)};
+    QVERIFY(wallet != nullptr);
+    WalletGuard guard{context, wallet};
+    MasternodeTestUtil::GuiModels models{m_node};
+    QVERIFY2(models.ok, qPrintable(QString::fromStdString(models.error.translated)));
+    WalletModel wallet_model(interfaces::MakeWallet(context, wallet), models.client);
+
     const std::vector<CAmount> amounts{400 * COIN, 300 * COIN, 300 * COIN};
     auto source{MakeSharedSource(amounts, 5 * COIN, /*early_period_blocks=*/1000)};
+    source->setShareOwner(1, ToKeyID(PKHash(test.coinbaseKey.GetPubKey())));
     MasternodeEntry entry{source, "collateral", 50};
     const auto& shares{entry.shares()};
     const uint256& protx{source->getProTxHash()};
 
-    DissolveDialog dialog(m_node, /*wallet_model=*/nullptr, entry, /*current_height=*/100, /*parent=*/nullptr);
+    DissolveDialog dialog(m_node, &wallet_model, entry, /*current_height=*/100, /*parent=*/nullptr);
 
     // The attack a unanimous dissolution makes possible: name the victim as
     // the actor, drop the actor output, and sweep the whole collateral to
@@ -973,7 +1090,8 @@ void MasternodeMaintenanceTests::dissolveRequestMustReturnPrincipal()
 
     // The honest template is adopted, and its payouts are on screen next to
     // the button that approves them
-    dialog.preloadEnvelope(MakeDissolveEnvelope(protx, shares));
+    const QString genuine{MakeDissolveEnvelope(protx, shares)};
+    dialog.preloadEnvelope(genuine);
     QVERIFY2(dialog.m_un_collector->hasTransaction(), qPrintable(dialog.m_un_collector->m_status_label->text()));
     QVERIFY(dialog.m_un_table->isVisibleTo(&dialog));
     QCOMPARE(dialog.m_un_table->rowCount(), 3);
@@ -984,4 +1102,43 @@ void MasternodeMaintenanceTests::dissolveRequestMustReturnPrincipal()
     QCOMPARE(dialog.m_un_table->item(2, 2)->text(), SharedMnFormatAmount(BitcoinUnits::Unit::DASH, amounts[2]));
     QVERIFY(dialog.m_un_fee_label->text().contains(SharedMnFormatAmount(BitcoinUnits::Unit::DASH, TEST_DISSOLVE_FEE)));
     QVERIFY(dialog.m_un_fee_label->text().contains("Share 1 of 3"));
+
+    // A refused message blocks approving, even with a valid request loaded
+    // before it: approving would sign that earlier request, not the refused
+    // one. v24 is not active here, so the button is disabled regardless; what
+    // this checks is the status and that nothing reaching the slot signs.
+    const QString loaded_tx{dialog.m_un_collector->txHex()};
+    CMutableTransaction underpaying{MakeDissolveTemplate(protx, /*actor_index=*/0, shares, TEST_DISSOLVE_FEE)};
+    underpaying.vout[1].nValue -= COIN;
+    UniValue other_network;
+    QVERIFY(other_network.read(genuine.toStdString()));
+    other_network.pushKV("network", "main");
+    for (const auto& [refused, reason] : {std::pair{MakeDissolveEnvelopeFor(protx, underpaying), "principal"},
+                                          std::pair{QString::fromStdString(other_network.write()), "network"}}) {
+        dialog.preloadEnvelope(genuine);
+        dialog.preloadEnvelope(refused);
+        const QString status{dialog.m_un_collector->m_status_label->text()};
+        QVERIFY2(status.contains(reason) && status.contains("cannot be approved") && !status.contains("ignored"),
+                 qPrintable(status));
+
+        dialog.approveTogether();
+        const bool signing_started{dialog.isBusy()};
+        QTRY_VERIFY(!dialog.isBusy());
+        QVERIFY(!signing_started);
+        QCOMPARE(dialog.m_un_collector->signedCount(), 0);
+        QCOMPARE(dialog.m_un_collector->txHex(), loaded_tx);
+    }
+
+    // A pasted message too large to read is refused the same way
+    dialog.preloadEnvelope(genuine);
+    QApplication::clipboard()->setText(QString(MAX_ENVELOPE_FILE_BYTES + 1, QLatin1Char('x')));
+    dialog.m_un_collector->pasteEnvelope();
+    const QString oversized_status{dialog.m_un_collector->m_status_label->text()};
+    QVERIFY2(oversized_status.contains("too large") && oversized_status.contains("cannot be approved"),
+             qPrintable(oversized_status));
+
+    // Opening the genuine request again lifts the block
+    dialog.preloadEnvelope(genuine);
+    QVERIFY2(!dialog.m_un_collector->m_status_label->text().contains("cannot be approved"),
+             qPrintable(dialog.m_un_collector->m_status_label->text()));
 }
diff --git a/src/qt/test/masternodewidgettests.cpp b/src/qt/test/masternodewidgettests.cpp
index 979ff8bbb0fd..d18b1355d33f 100644
--- a/src/qt/test/masternodewidgettests.cpp
+++ b/src/qt/test/masternodewidgettests.cpp
@@ -110,7 +110,12 @@ class BlockingEVO final : public interfaces::EVO
     std::pair<interfaces::MnListPtr, const CBlockIndex*> getListAtChainTip() override { return {}; }
     interfaces::ProviderTxCapabilities getProviderTxCapabilities() override { return {}; }
     std::optional<interfaces::ProviderTxError> validateProviderNetInfo(const interfaces::ProviderNetInfo&, MnType,
-                                                                       uint16_t, bool) override
+                                                                       uint16_t, bool, bool) override
+    {
+        return std::nullopt;
+    }
+    std::optional<std::string> findProviderNetInfoInUse(const interfaces::ProviderNetInfo&, MnType, uint16_t,
+                                                        bool) override
     {
         return std::nullopt;
     }
@@ -310,11 +315,10 @@ void MasternodeWidgetTests::providerNetInfoValidation_data()
     const int evo{static_cast<int>(MnType::Evo)};
     const int basic{ProTxVersion::BasicBLS};
     const int extended{ProTxVersion::ExtAddr};
-    const QString core1{QString("1.1.1.1:%1").arg(Params().GetDefaultPort())};
-    const QString core2{QString("1.1.1.2:%1").arg(Params().GetDefaultPort())};
-    const int wrong_network_port{Params().GetDefaultPort() == MainParams().GetDefaultPort()
-                                     ? MainParams().GetDefaultPort() + 1
-                                     : MainParams().GetDefaultPort()};
+    // providerNetInfoValidation() runs on mainnet
+    const QString core1{QString("1.1.1.1:%1").arg(MainParams().GetDefaultPort())};
+    const QString core2{QString("1.1.1.2:%1").arg(MainParams().GetDefaultPort())};
+    const int wrong_network_port{MainParams().GetDefaultPort() + 1};
 
     const auto add_row = [](const char* name, int type, int version, bool optional, QStringList core, QStringList p2p,
                             QStringList https, int p2p_port, int https_port, bool valid, QString error = {}) {
@@ -343,18 +347,18 @@ void MasternodeWidgetTests::providerNetInfoValidation_data()
     add_row("evo-basic-ports", evo, basic, true, {core1}, {}, {}, 26656, 443, true);
     add_row("evo-basic-zero-port", evo, basic, true, {core1}, {}, {}, 0, 443, false, "valid port");
     add_row("evo-extended-all-empty", evo, extended, true, {}, {}, {}, -1, -1, true);
-    add_row("evo-extended-complete", evo, extended, true, {core1}, {"1.1.1.2:26656"}, {"example.com:443"}, -1, -1, true);
+    add_row("evo-extended-complete", evo, extended, true, {core1}, {"1.1.1.1:26656"}, {"1.1.1.1:443"}, -1, -1, true);
     add_row("evo-extended-platform-only", evo, extended, true, {}, {"1.1.1.2:26656"}, {"example.com:443"}, -1, -1,
             false, "bad-protx-netinfo-empty");
-    add_row("evo-extended-https-domain", evo, extended, true, {core1}, {"1.1.1.2:26656"}, {"rpc.example.org:443"}, -1,
-            -1, true);
+    add_row("evo-extended-https-domain", evo, extended, true, {core1}, {"1.1.1.1:26656"},
+            {"1.1.1.1:443", "rpc.example.org:443"}, -1, -1, true);
     add_row("evo-extended-p2p-domain", evo, extended, true, {core1}, {"p2p.example.org:26656"}, {"rpc.example.org:443"},
             -1, -1, false, "invalid input");
     add_row("evo-extended-core-only", evo, extended, true, {core1}, {}, {}, -1, -1, false,
             "cannot be empty if other fields populated");
-    add_row("evo-extended-one-platform-family", evo, extended, true, {core1}, {"1.1.1.2:26656"}, {}, -1, -1, false,
+    add_row("evo-extended-one-platform-family", evo, extended, true, {core1}, {"1.1.1.1:26656"}, {}, -1, -1, false,
             "cannot be empty if other fields populated");
-    add_row("evo-extended-cross-purpose-duplicate", evo, extended, true, {core1}, {"1.1.1.2:26656"}, {"1.1.1.2:26656"},
+    add_row("evo-extended-cross-purpose-duplicate", evo, extended, true, {core1}, {"1.1.1.1:26656"}, {"1.1.1.1:26656"},
             -1, -1, false, "duplicate");
     add_row("invalid-version", regular, 0, true, {}, {}, {}, -1, -1, false, "invalid provider transaction version");
     add_row("invalid-type", static_cast<int>(MnType::Invalid), basic, true, {}, {}, {}, -1, -1, false,
@@ -363,6 +367,8 @@ void MasternodeWidgetTests::providerNetInfoValidation_data()
 
 void MasternodeWidgetTests::providerNetInfoValidation()
 {
+    BasicTestingSetup test{CBaseChainParams::MAIN};
+    m_node.setContext(&test.m_node);
     QFETCH(int, mn_type);
     QFETCH(int, version);
     QFETCH(bool, optional);
@@ -394,7 +400,8 @@ void MasternodeWidgetTests::providerNetInfoValidation()
     }
 
     const auto error{m_node.evo().validateProviderNetInfo(net_info, static_cast<MnType>(mn_type),
-                                                          static_cast<uint16_t>(version), optional)};
+                                                          static_cast<uint16_t>(version), /*ipv4_optional=*/false,
+                                                          optional)};
     QCOMPARE(!error.has_value(), valid);
     if (!valid) {
         QVERIFY(error.has_value());
diff --git a/src/qt/test/sharedmnwalkthroughtests.cpp b/src/qt/test/sharedmnwalkthroughtests.cpp
index 694ed035502f..6ea9e0c8bf4e 100644
--- a/src/qt/test/sharedmnwalkthroughtests.cpp
+++ b/src/qt/test/sharedmnwalkthroughtests.cpp
@@ -10,6 +10,7 @@
 #include <chain.h>
 #include <chainparams.h>
 #include <consensus/amount.h>
+#include <core_io.h>
 #include <evo/deterministicmns.h>
 #include <interfaces/node.h>
 #include <interfaces/wallet.h>
@@ -33,6 +34,7 @@
 #include <script/standard.h>
 #include <test/util/setup_common.h>
 #include <univalue.h>
+#include <util/strencodings.h>
 #include <util/system.h>
 #include <util/translation.h>
 #include <validation.h>
@@ -184,6 +186,8 @@ class ModalPilot : public QObject
 
     //! Everything answered so far, for failure messages
     const QStringList& seen() const { return m_seen; }
+    //! Window titles of those boxes, in the same order
+    const QStringList& titles() const { return m_titles; }
 
 private:
     void poll()
@@ -207,6 +211,7 @@ class ModalPilot : public QObject
             // counts down; wait for it rather than cancelling the flow.
             if (target != nullptr && !target->isEnabled()) return;
             m_pending = nullptr;
+            m_titles << box->windowTitle();
             m_seen << (box->text() + QLatin1Char('\n') + box->informativeText() + QLatin1Char('\n') + box->detailedText());
             if (!m_queued.isEmpty()) {
                 const Shot shot{m_queued.takeFirst()};
@@ -234,6 +239,7 @@ class ModalPilot : public QObject
     QTimer m_timer;
     QWidget* m_pending{nullptr};
     QStringList m_seen;
+    QStringList m_titles;
     QList<Shot> m_queued;
 };
 
@@ -994,6 +1000,36 @@ void SharedMnWalkthroughTests::walkthrough()
                           "Dissolve together after Prepare Request: the envelope and the approval board",
                           /*fixed_size=*/false);
 
+        // A refused message blocks Approve, even though the request prepared
+        // above is still loaded: approving would sign that one, not the refused
+        // one. The prepared request and its approvals are kept, and opening the
+        // request again lifts the block.
+        QVERIFY(dialog.m_un_approve->isEnabled());
+        const int approved{dialog.m_un_collector->signedCount()};
+        const QString prepared_tx{dialog.m_un_collector->txHex()};
+        const UniValue genuine{dialog.m_un_collector->envelopeJson()};
+        CMutableTransaction underpaying;
+        QVERIFY(DecodeHexTx(underpaying, prepared_tx.toStdString()));
+        underpaying.vout[0].nValue -= COIN;
+        UniValue underpaying_envelope{genuine};
+        underpaying_envelope.pushKV("tx", EncodeHexTx(CTransaction(underpaying)));
+        UniValue other_network{genuine};
+        other_network.pushKV("network", "main");
+        for (const auto& [refused, reason] :
+             {std::pair{underpaying_envelope, "principal"}, std::pair{other_network, "network"}}) {
+            dialog.preloadEnvelope(QString::fromStdString(refused.write()));
+            const QString status{dialog.m_un_collector->m_status_label->text()};
+            QVERIFY2(status.contains(reason) && status.contains("cannot be approved"), qPrintable(status));
+            QVERIFY(!dialog.m_un_approve->isEnabled());
+            dialog.approveTogether();
+            QVERIFY(!dialog.isBusy());
+            QCOMPARE(dialog.m_un_collector->signedCount(), approved);
+            QCOMPARE(dialog.m_un_collector->txHex(), prepared_tx);
+        }
+        dialog.preloadEnvelope(QString::fromStdString(genuine.write()));
+        QVERIFY(dialog.m_un_approve->isEnabled());
+        QVERIFY(!dialog.m_un_collector->m_status_label->text().contains("cannot be approved"));
+
         dialog.selectStandbyTab();
         ShotRecorder::settle();
         QCOMPARE(dialog.m_tabs->currentIndex(), dialog.m_standby_tab_index);
@@ -1018,6 +1054,34 @@ void SharedMnWalkthroughTests::walkthrough()
         Shots().capture(&dialog, "maintenance", "39-standby-created",
                           "Standby dissolution tab with both offline transactions generated and stored",
                           /*fixed_size=*/false);
+
+        // Pasting the full-principal standby (the file's first transaction) while
+        // the early period still runs: the network refuses it, and the list must
+        // say so, not report it as sent
+        QFile standby_file{standby_path};
+        QVERIFY(standby_file.open(QIODevice::ReadOnly | QIODevice::Text));
+        QString standby_hex;
+        for (const QString& line : QString::fromUtf8(standby_file.readAll()).split(QLatin1Char('\n'))) {
+            if (!line.isEmpty() && IsHex(line.toStdString())) {
+                standby_hex = line;
+                break;
+            }
+        }
+        QVERIFY(!standby_hex.isEmpty());
+        const auto answered{pilot.seen().size()};
+        list.openSharedMessage(standby_hex);
+        QCOMPARE(pilot.seen().size(), answered + 2);
+        const QString result{pilot.seen().last()};
+        QVERIFY2(pilot.titles().last() == QStringLiteral("Broadcast failed") && result.contains("early-exit penalty") &&
+                     result.contains("bad-prodis-penalty-floor"),
+                 qPrintable(pilot.titles().last() + QLatin1Char('\n') + result));
+        CMutableTransaction standby_full;
+        QVERIFY(DecodeHexTx(standby_full, standby_hex.toStdString()));
+        UniValue params(UniValue::VOBJ);
+        params.pushKV("txid", CTransaction(standby_full).GetHash().ToString());
+        UniValue entry;
+        const QString mempool_error{RunRpc(m_node, "getmempoolentry", params, entry)};
+        QVERIFY2(mempool_error.contains("Transaction not in mempool"), qPrintable(mempool_error));
     }
     {
         RotateSharedKeysDialog dialog(m_node, &coord_model, *shared_entry);
diff --git a/src/qt/test/sharedmnwizardtests.cpp b/src/qt/test/sharedmnwizardtests.cpp
index fcf571989bad..50ae27f77f61 100644
--- a/src/qt/test/sharedmnwizardtests.cpp
+++ b/src/qt/test/sharedmnwizardtests.cpp
@@ -20,7 +20,9 @@
 #include <chainparams.h>
 #include <consensus/amount.h>
 #include <core_io.h>
+#include <evo/deterministicmns.h>
 #include <evo/dmn_types.h>
+#include <evo/netinfo.h>
 #include <evo/providertx.h>
 #include <evo/sharedcollateral.h>
 #include <evo/specialtx.h>
@@ -37,6 +39,7 @@
 #include <util/strencodings.h>
 #include <util/system.h>
 #include <util/translation.h>
+#include <validation.h>
 #include <wallet/context.h>
 #include <wallet/transaction.h>
 #include <wallet/wallet.h>
@@ -48,14 +51,19 @@
 #include <QButtonGroup>
 #include <QClipboard>
 #include <QLabel>
+#include <QLineEdit>
+#include <QMessageBox>
 #include <QPushButton>
+#include <QStackedWidget>
 #include <QStandardItemModel>
 #include <QString>
+#include <QTableWidget>
 #include <QTest>
 #include <QTimer>
 #include <QWidget>
 
 #include <algorithm>
+#include <functional>
 #include <limits>
 #include <memory>
 #include <string>
@@ -101,6 +109,26 @@ MnShareSession FrozenSession(const MnShareSession& draft, const std::vector<CKey
     }
     return session;
 }
+
+//! Answer the next message box with its button labelled `answer`, recording
+//! the box's title in `title`, which stays empty if no box opens before the
+//! caller processes events
+void AnswerMessageBox(const QString& answer, QString& title)
+{
+    title.clear();
+    QTimer::singleShot(0, [answer, &title] {
+        auto* const box{qobject_cast<QMessageBox*>(QApplication::activeModalWidget())};
+        if (box == nullptr) return;
+        title = box->windowTitle();
+        for (QAbstractButton* const button : box->buttons()) {
+            if (button->text() == answer) {
+                button->click();
+                return;
+            }
+        }
+        box->reject();
+    });
+}
 } // anonymous namespace
 
 void SharedMnWizardTests::coordinatorPageOrder()
@@ -314,15 +342,38 @@ void SharedMnWizardTests::coordinatorResumesSavedSession()
     QCOMPARE(dialog.myShareIndex(), 0);
     QVERIFY(dialog.allDetailsCollected());
 
+    // The operator key already went out with the invitation, so Back must not
+    // offer a freshly generated secret to save in its place
+    dialog.onBack();
+    QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageContribution));
+    QVERIFY(!dialog.m_order.contains(SharedMnCreateDialog::PageSecret));
+    dialog.goToPage(SharedMnCreateDialog::PageInvite);
+
     // alice's coins are reserved, so the coordinator cannot move to another row
     dialog.refreshShareTable();
     QVERIFY(!dialog.m_me_group->button(0)->isEnabled());
     QVERIFY(!dialog.m_me_group->button(1)->isEnabled());
 
+    // Nor can the contribution page show addresses or a fee other than the ones
+    // the coins were reserved for
+    auto* const fee_input{dialog.m_fee_field->findChild<QLineEdit*>()};
+    QVERIFY(fee_input != nullptr);
+    QVERIFY(!fee_input->isEnabled());
+    QCOMPARE(dialog.m_new_address_buttons.size(), 3);
+    for (QPushButton* const button : dialog.m_new_address_buttons) {
+        button->click();
+    }
+    QCOMPARE(dialog.m_owner_edit->text(), saved.shares()[0].ownerAddress);
+    QCOMPARE(dialog.m_refund_edit->text(), saved.shares()[0].refundAddress);
+    QVERIFY(dialog.m_reward_edit->text().isEmpty());
+
     // Without the reservation the coordinator's own row is free again, but bob's
     // and carol's still belong to them
     dialog.releaseCoins();
     QVERIFY(dialog.myContribution() == nullptr);
+    QVERIFY(fee_input->isEnabled());
+    dialog.m_new_address_buttons[1]->click();
+    QVERIFY(dialog.m_refund_edit->text() != saved.shares()[0].refundAddress);
     QVERIFY(dialog.m_me_group->button(0)->isEnabled());
     QVERIFY(!dialog.m_me_group->button(1)->isEnabled());
     QVERIFY(!dialog.m_me_group->button(2)->isEnabled());
@@ -404,6 +455,324 @@ void SharedMnWizardTests::coordinatorResumesFullySignedSession()
     QCOMPARE(int(participant.currentPage()), int(SharedMnCreateDialog::PageWaitBroadcast));
 }
 
+void SharedMnWizardTests::signedSessionReservation()
+{
+    TestingSetup test{CBaseChainParams::REGTEST};
+    m_node.setContext(&test.m_node);
+    WalletContext& context{*m_node.walletLoader().context()};
+
+    // bob's wallet knows a transaction that paid both bob and alice, such as
+    // the change of an earlier shared registration, and each funds their share
+    // in this one with their own output of it
+    CKey bob_key;
+    bob_key.MakeNewKey(/*fCompressed=*/true);
+    const auto wallet{MakeSpendingWallet(m_node, context, "bob", bob_key)};
+    QVERIFY(wallet != nullptr);
+    WalletGuard guard{context, wallet};
+    CKey alice_coin_key;
+    CMutableTransaction earlier;
+    earlier.vin.emplace_back(COutPoint(uint256::ONE, 0));
+    earlier.vout.emplace_back(350 * COIN, GetScriptForDestination(PKHash(bob_key.GetPubKey())));
+    earlier.vout.emplace_back(400 * COIN, GetScriptForDestination(
+                                              DecodeDestination(FreshP2PKHAddress(&alice_coin_key).toStdString())));
+    QVERIFY(wallet->AddToWallet(MakeTransactionRef(earlier), wallet::TxStateInactive{}) != nullptr);
+    const QString earlier_txid{QString::fromStdString(earlier.GetHash().ToString())};
+    const COutPoint bob_coin{earlier.GetHash(), 0};
+    const COutPoint alice_coin{earlier.GetHash(), 1};
+
+    MasternodeTestUtil::GuiModels models{m_node};
+    QVERIFY2(models.ok, qPrintable(QString::fromStdString(models.error.translated)));
+    WalletModel wallet_model(interfaces::MakeWallet(context, wallet), models.client);
+
+    // Share `index`'s approval of `session`'s terms, signed with `key`
+    const auto approve = [](MnShareSession& session, int index, const CKey& key) {
+        std::vector<unsigned char> signature;
+        QString error;
+        return CHashSigner::SignHash(uint256S(session.consentHash().toStdString()), key, signature) &&
+               session.addSignature(index, QString::fromStdString(EncodeBase64(signature)), error);
+    };
+    // The session once every share has signed its coins, as bob receives it or,
+    // with `coordinated`, as bob coordinating it saved it. Without
+    // `fully_signed` it is the signing request, before anybody signed. With
+    // `last_key` it is still collecting approvals: alice and bob have approved,
+    // and `last_key` receives carol's owner key.
+    const auto signed_session = [&](bool coordinated, bool fully_signed = true, CKey* last_key = nullptr) {
+        MnShareSession invitation{InvitationSession()};
+        if (coordinated) {
+            invitation.setCoordinatorLabel(QStringLiteral("bob"));
+            invitation.setPrepareWallet(QStringLiteral("bob"));
+        }
+        MnShareSession draft{invitation};
+        std::vector<CKey> owner_keys(3);
+        QString error;
+        for (int i = 0; i < 3; ++i) {
+            draft.absorbDraftReply(DraftReply(invitation, i, FakeTxid('1' + i), &owner_keys[i]), error);
+        }
+        owner_keys[1] = bob_key;
+        draft.shares()[1].ownerAddress = QString::fromStdString(EncodeDestination(PKHash(bob_key.GetPubKey())));
+        for (const auto& [label, vout] : {std::pair{"alice", 1u}, std::pair{"bob", 0u}}) {
+            MnShareSession::Contribution contribution;
+            contribution.label = QString::fromLatin1(label);
+            contribution.inputs = {{.txid = earlier_txid, .vout = vout}};
+            draft.removeContribution(contribution.label, error);
+            draft.addContribution(contribution, error);
+        }
+        if (last_key != nullptr) {
+            *last_key = owner_keys[2];
+            MnShareSession frozen{FrozenSession(draft, owner_keys, /*sign_all=*/false)};
+            for (const int i : {0, 1}) {
+                approve(frozen, i, owner_keys[i]);
+            }
+            return frozen;
+        }
+        MnShareSession session{FrozenSession(draft, owner_keys, /*sign_all=*/true)};
+        session.setCombinedTx(session.protxHex(), error);
+        CMutableTransaction tx;
+        if (!fully_signed || !DecodeHexTx(tx, session.protxHex().toStdString())) return session;
+        for (auto& input : tx.vin) {
+            input.scriptSig = CScript() << OP_TRUE;
+        }
+        session.setFundingSignedTx(QString::fromStdString(EncodeHexTx(CTransaction(tx))), error);
+        return session;
+    };
+    const MnShareSession received{signed_session(/*coordinated=*/false)};
+    QCOMPARE(int(received.stage()), int(MnShareSession::Stage::FundingSigned));
+
+    {
+        // Only bob's own coin is reserved: a lock on alice's would be one bob
+        // could neither see nor release in Coin Control
+        SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+        dialog.handleImportedText(received.toJsonString());
+        QCOMPARE(int(dialog.m_role), int(SharedMnCreateDialog::Role::Participant));
+        QCOMPARE(dialog.myShareIndex(), 1);
+        QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageWaitBroadcast));
+        QVERIFY(wallet_model.wallet().isLockedCoin(bob_coin));
+        QVERIFY(!wallet_model.wallet().isLockedCoin(alice_coin));
+
+        // A lock left on alice's coin by an earlier version is not one of bob's
+        // to release
+        wallet_model.wallet().unlockCoin(bob_coin);
+        wallet_model.wallet().lockCoin(alice_coin, /*write_to_db=*/false);
+        QVERIFY(!dialog.hasLockedContributedCoins());
+        wallet_model.wallet().unlockCoin(alice_coin);
+    }
+
+    // Whether the page on screen offers "Release my coins"
+    const auto offers_release = [](const SharedMnCreateDialog& dialog) {
+        const auto buttons{dialog.m_pages->currentWidget()->findChildren<QPushButton*>()};
+        return std::any_of(buttons.begin(), buttons.end(), [](const QPushButton* button) {
+            return button->text() == QStringLiteral("Release my coins") && !button->isHidden();
+        });
+    };
+    const QString keep_prompt{QStringLiteral("Keep this session for later?")};
+    QString prompt;
+    {
+        // Nothing was changed since the session was opened, but its coins stay
+        // reserved once the dialog closes, so Close and Cancel both ask first
+        SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+        dialog.handleImportedText(received.toJsonString());
+        dialog.show();
+        QVERIFY(offers_release(dialog));
+        AnswerMessageBox(QStringLiteral("Cancel"), prompt);
+        dialog.onNext();
+        QCoreApplication::processEvents();
+        QCOMPARE(prompt, keep_prompt);
+        QVERIFY(dialog.isVisible());
+        QVERIFY(wallet_model.wallet().isLockedCoin(bob_coin));
+
+        AnswerMessageBox(QStringLiteral("Discard and Release Coins"), prompt);
+        dialog.reject();
+        QCoreApplication::processEvents();
+        QCOMPARE(prompt, keep_prompt);
+        QVERIFY(!dialog.isVisible());
+        QVERIFY(!wallet_model.wallet().isLockedCoin(bob_coin));
+    }
+    {
+        // The coordinator's copy, opened from its file, offers the same choice
+        // and, having no waiting page, a way to release the coins where a
+        // registration that cannot be broadcast leaves it
+        SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+        dialog.handleImportedText(signed_session(/*coordinated=*/true).toJsonString());
+        QCOMPARE(int(dialog.m_role), int(SharedMnCreateDialog::Role::Coordinator));
+        QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageSignatures));
+        QVERIFY(wallet_model.wallet().isLockedCoin(bob_coin));
+        dialog.show();
+        QVERIFY(offers_release(dialog));
+        AnswerMessageBox(QStringLiteral("Cancel"), prompt);
+        dialog.reject();
+        QCoreApplication::processEvents();
+        QCOMPARE(prompt, keep_prompt);
+        QVERIFY(dialog.isVisible());
+        QVERIFY(wallet_model.wallet().isLockedCoin(bob_coin));
+    }
+    {
+        // Released coins stay released when another copy of the session
+        // arrives, so the status line saying so stays true
+        SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+        dialog.handleImportedText(received.toJsonString());
+        QVERIFY(wallet_model.wallet().isLockedCoin(bob_coin));
+        AnswerMessageBox(QStringLiteral("Release"), prompt);
+        dialog.releaseReservedCoins();
+        QCoreApplication::processEvents();
+        QCOMPARE(prompt, QStringLiteral("Release your coins?"));
+        QVERIFY(!wallet_model.wallet().isLockedCoin(bob_coin));
+        QVERIFY(dialog.m_status_label->text().startsWith(QStringLiteral("Released")));
+
+        dialog.handleImportedText(received.toJsonString());
+        QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageWaitBroadcast));
+        QVERIFY(!wallet_model.wallet().isLockedCoin(bob_coin));
+        QVERIFY(!offers_release(dialog));
+        QVERIFY(dialog.m_status_label->text().startsWith(QStringLiteral("Released")));
+    }
+    {
+        // Signing the coins into the registration reserves them again. This
+        // fixture's coins are not in the chainstate, so the wallet adds no
+        // signature, but the signing step still completes.
+        SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+        dialog.handleImportedText(signed_session(/*coordinated=*/false, /*fully_signed=*/false).toJsonString());
+        QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageSignatures));
+        QVERIFY(wallet_model.wallet().isLockedCoin(bob_coin));
+        AnswerMessageBox(QStringLiteral("Release"), prompt);
+        dialog.releaseReservedCoins();
+        QCoreApplication::processEvents();
+        QVERIFY(!wallet_model.wallet().isLockedCoin(bob_coin));
+        bool complete{true};
+        QString sign_error;
+        QVERIFY2(dialog.signOwnFundingInputs(complete, sign_error), qPrintable(sign_error));
+        QVERIFY(wallet_model.wallet().isLockedCoin(bob_coin));
+        wallet_model.wallet().unlockCoin(bob_coin);
+    }
+    {
+        // bob coordinates and releases his coins while the approvals come in.
+        // The last approval completes the set, but nothing of bob's is
+        // combined, signed or reserved again until bob asks for it.
+        CKey carol_key;
+        const MnShareSession waiting{signed_session(/*coordinated=*/true, /*fully_signed=*/false, &carol_key)};
+        MnShareSession approved{waiting};
+        QVERIFY(approve(approved, 2, carol_key));
+        SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+        dialog.handleImportedText(waiting.toJsonString());
+        QCOMPARE(int(dialog.m_role), int(SharedMnCreateDialog::Role::Coordinator));
+        QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageApprovals));
+        QVERIFY(!dialog.allApproved());
+        QVERIFY(wallet_model.wallet().isLockedCoin(bob_coin));
+        AnswerMessageBox(QStringLiteral("Release"), prompt);
+        dialog.releaseReservedCoins();
+        QCoreApplication::processEvents();
+        QVERIFY(!wallet_model.wallet().isLockedCoin(bob_coin));
+
+        dialog.handleImportedText(approved.toJsonString());
+        QVERIFY(dialog.allApproved());
+        QTRY_VERIFY_WITH_TIMEOUT(!dialog.m_busy, 10000);
+        QCOMPARE(int(dialog.m_session.stage()), int(MnShareSession::Stage::Signing));
+        QCOMPARE(dialog.m_session.protxHex(), waiting.protxHex());
+        QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageApprovals));
+        QVERIFY(!wallet_model.wallet().isLockedCoin(bob_coin));
+        QVERIFY2(dialog.m_status_label->text().contains(QStringLiteral("nothing was signed")),
+                 qPrintable(dialog.m_status_label->text()));
+        QCOMPARE(dialog.m_next_button->text(), QStringLiteral("Reserve and Sign"));
+
+        // Pressing it reserves the coins again and combines and signs as usual
+        dialog.onNext();
+        QVERIFY(wallet_model.wallet().isLockedCoin(bob_coin));
+        QTRY_VERIFY_WITH_TIMEOUT(!dialog.m_busy, 10000);
+        QVERIFY2(dialog.m_error_label->text().isEmpty(), qPrintable(dialog.m_error_label->text()));
+        QCOMPARE(int(dialog.m_session.stage()), int(MnShareSession::Stage::Combined));
+        QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageSignatures));
+        QVERIFY(wallet_model.wallet().isLockedCoin(bob_coin));
+        wallet_model.wallet().unlockCoin(bob_coin);
+    }
+    {
+        // bob coordinates, reserves his coin and sends the invitation, which
+        // carries his contribution. He then releases it on the contribution
+        // page. A reply made from that invitation fills in alice's row and her
+        // coins, but bob's contribution comes back only through Reserve.
+        MnShareSession invitation{InvitationSession()};
+        invitation.setCoordinatorLabel(QStringLiteral("bob"));
+        invitation.setPrepareWallet(QStringLiteral("bob"));
+        invitation.shares()[1].ownerAddress = QString::fromStdString(EncodeDestination(PKHash(bob_key.GetPubKey())));
+        invitation.shares()[1].refundAddress = FreshP2PKHAddress();
+        MnShareSession::Contribution reserved;
+        reserved.label = QStringLiteral("bob");
+        reserved.inputs = {{.txid = earlier_txid, .vout = 0}};
+        QString error;
+        QVERIFY2(invitation.addContribution(reserved, error), qPrintable(error));
+
+        SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+        dialog.handleImportedText(invitation.toJsonString());
+        QCOMPARE(int(dialog.m_role), int(SharedMnCreateDialog::Role::Coordinator));
+        QCOMPARE(dialog.myShareIndex(), 1);
+        QVERIFY(dialog.myContribution() != nullptr);
+        QVERIFY(wallet_model.wallet().isLockedCoin(bob_coin));
+        dialog.releaseCoins();
+        QVERIFY(dialog.myContribution() == nullptr);
+        QVERIFY(!wallet_model.wallet().isLockedCoin(bob_coin));
+
+        const auto contributes = [&dialog](const char* label) {
+            const auto& contributions{dialog.m_session.contributions()};
+            return std::any_of(contributions.begin(), contributions.end(), [label](const auto& contribution) {
+                return contribution.label == QString::fromLatin1(label);
+            });
+        };
+        const MnShareSession reply{DraftReply(invitation, 0, FakeTxid('7'))};
+        dialog.handleImportedText(reply.toJsonString());
+        QVERIFY2(dialog.m_error_label->text().isEmpty(), qPrintable(dialog.m_error_label->text()));
+        QVERIFY(!wallet_model.wallet().isLockedCoin(bob_coin));
+        QCOMPARE(dialog.myShareIndex(), 1);
+        QVERIFY(dialog.myContribution() == nullptr);
+        QVERIFY(!contributes("bob"));
+        QVERIFY(!dialog.m_reserve_button->isHidden());
+        QCOMPARE(dialog.m_session.shares()[0].ownerAddress, reply.shares()[0].ownerAddress);
+        QVERIFY(contributes("alice"));
+
+        // Choosing carol's still empty row as "me" after the release must not
+        // cost carol her contribution when her reply arrives
+        dialog.goToPage(SharedMnCreateDialog::PageParticipants);
+        dialog.m_me_group->button(2)->setChecked(true);
+        dialog.syncSharesFromTable();
+        QCOMPARE(dialog.myShareIndex(), 2);
+        dialog.handleImportedText(DraftReply(invitation, 2, FakeTxid('8')).toJsonString());
+        QVERIFY2(dialog.m_error_label->text().isEmpty(), qPrintable(dialog.m_error_label->text()));
+        QVERIFY(contributes("carol"));
+        QVERIFY(!contributes("bob"));
+        QVERIFY(!wallet_model.wallet().isLockedCoin(bob_coin));
+    }
+
+    // The registration is broadcast, which spends bob's coin as intended
+    CMutableTransaction registration;
+    QVERIFY(DecodeHexTx(registration, received.protxHex().toStdString()));
+    QVERIFY(wallet->AddToWallet(MakeTransactionRef(registration), wallet::TxStateInactive{}) != nullptr);
+    {
+        SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+        dialog.handleImportedText(received.toJsonString());
+        QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageWaitBroadcast));
+        QCOMPARE(dialog.m_next_button->text(), QStringLiteral("Close"));
+        QVERIFY2(dialog.m_error_label->text().isEmpty(), qPrintable(dialog.m_error_label->text()));
+    }
+
+    {
+        // Another session counting on the same coin can never be broadcast now,
+        // and the page says so next to the "Start Over" it offers instead
+        SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+        dialog.handleImportedText(signed_session(/*coordinated=*/false).toJsonString());
+        QCOMPARE(dialog.m_next_button->text(), QStringLiteral("Start Over"));
+        QVERIFY2(dialog.m_error_label->text().contains(QStringLiteral("was spent")),
+                 qPrintable(dialog.m_error_label->text()));
+    }
+
+    // An abandoned registration spends nothing: once bob spends the coin
+    // elsewhere, the session is as dead as any other
+    QVERIFY(wallet->AbandonTransaction(registration.GetHash()));
+    CMutableTransaction spend;
+    spend.vin.emplace_back(bob_coin);
+    spend.vout.emplace_back(349 * COIN, GetScriptForDestination(PKHash(bob_key.GetPubKey())));
+    QVERIFY(wallet->AddToWallet(MakeTransactionRef(spend), wallet::TxStateInactive{}) != nullptr);
+    SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+    dialog.handleImportedText(received.toJsonString());
+    QCOMPARE(dialog.m_next_button->text(), QStringLiteral("Start Over"));
+    QVERIFY2(dialog.m_error_label->text().contains(QStringLiteral("was spent")), qPrintable(dialog.m_error_label->text()));
+}
+
 void SharedMnWizardTests::unauthorisedSignedInputsAreDetected()
 {
     BasicTestingSetup setup{CBaseChainParams::REGTEST};
@@ -578,9 +947,10 @@ void SharedMnWizardTests::refusesToSignShortChangedOwnContribution()
     // A combined session in which bob's own contribution spends that coin and
     // sends `change_amount` to `change_address`. Every envelope check passes:
     // the file and the transaction agree with each other. With `coordinated`
-    // the session is bob's own, reopened from a backup.
-    const auto session_with_change = [&](const QString& change_address, CAmount change_amount,
-                                         bool coordinated = false, uint32_t vout = 0) {
+    // the session is bob's own, reopened from a backup. `alice_extra_change` is
+    // added to alice's change.
+    const auto session_with_change = [&](const QString& change_address, CAmount change_amount, bool coordinated = false,
+                                         uint32_t vout = 0, CAmount alice_extra_change = 0) {
         MnShareSession invitation{InvitationSession()};
         if (coordinated) {
             invitation.setCoordinatorLabel(QStringLiteral("bob"));
@@ -594,6 +964,12 @@ void SharedMnWizardTests::refusesToSignShortChangedOwnContribution()
         }
         owner_keys[1] = victim_key;
         draft.shares()[1].ownerAddress = own_address;
+        if (alice_extra_change != 0) {
+            MnShareSession::Contribution alice{draft.contributions().front()};
+            alice.changeAmount += alice_extra_change;
+            draft.removeContribution(alice.label, error);
+            draft.addContribution(alice, error);
+        }
         draft.removeContribution(QStringLiteral("bob"), error);
         draft.addContribution({.label = QStringLiteral("bob"),
                                .inputs = {{.txid = coin_txid, .vout = vout}},
@@ -655,6 +1031,37 @@ void SharedMnWizardTests::refusesToSignShortChangedOwnContribution()
         QCOMPARE(int(dialog.m_role), int(SharedMnCreateDialog::Role::Coordinator));
         QVERIFY2(dialog.m_funding_refusal.isEmpty(), qPrintable(dialog.m_funding_refusal));
     }
+    // A copy of the coordinator's own session that moves 0.5 DASH of its change
+    // to alice's: the transaction fee is still 0.001, so signing stays refused
+    // even though the coins line shows what the coins now pay
+    {
+        SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+        dialog.handleImportedText(session_with_change(own_address, 100 * COIN - COIN / 1000 - COIN / 2,
+                                                      /*coordinated=*/true, /*vout=*/0,
+                                                      /*alice_extra_change=*/COIN / 2)
+                                      .toJsonString());
+        QCOMPARE(int(dialog.m_role), int(SharedMnCreateDialog::Role::Coordinator));
+        const QString refusal{dialog.m_funding_refusal};
+        QVERIFY2(refusal.contains(QStringLiteral("returns only %1").arg(amount(100 * COIN - COIN / 1000 - COIN / 2))),
+                 qPrintable(refusal));
+        QVERIFY(!dialog.m_next_button->isEnabled());
+        // What the coins pay beyond the share is shown next to the field's
+        // value, and is not called the network fee: half of it went to alice
+        const QString coins{dialog.m_coins_label->text()};
+        QVERIFY2(coins.contains(QStringLiteral("These coins pay %1 beyond your share, not the %2 Network fee")
+                                    .arg(amount(COIN / 2 + COIN / 1000), amount(dialog.m_fee_field->value()))),
+                 qPrintable(coins));
+        QVERIFY2(!coins.contains(QStringLiteral("(network fee)")), qPrintable(coins));
+    }
+    // A copy whose recorded change exceeds the coin minus the share pays
+    // nothing beyond the share, so no negative amount is shown
+    {
+        SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+        dialog.handleImportedText(session_with_change(own_address, 101 * COIN, /*coordinated=*/true).toJsonString());
+        QCOMPARE(int(dialog.m_role), int(SharedMnCreateDialog::Role::Coordinator));
+        QVERIFY2(!dialog.m_coins_label->text().contains(QStringLiteral("beyond your share")),
+                 qPrintable(dialog.m_coins_label->text()));
+    }
     // A file naming a coin this wallet holds with an output index past the end
     // of its transaction is not a coin of ours, and must not crash the import
     {
@@ -673,6 +1080,389 @@ void SharedMnWizardTests::refusesToSignShortChangedOwnContribution()
     expect_refusal(session_with_change(own_address, 50 * COIN), 50 * COIN);
 }
 
+void SharedMnWizardTests::newerRevisionKeepsOwnShare()
+{
+    TestingSetup test{CBaseChainParams::REGTEST};
+    m_node.setContext(&test.m_node);
+    WalletContext& context{*m_node.walletLoader().context()};
+
+    CKey own_key;
+    own_key.MakeNewKey(/*fCompressed=*/true);
+    const auto wallet{MakeSpendingWallet(m_node, context, "participant", own_key)};
+    QVERIFY(wallet != nullptr);
+    WalletGuard guard{context, wallet};
+    MasternodeTestUtil::GuiModels models{m_node};
+    QVERIFY2(models.ok, qPrintable(QString::fromStdString(models.error.translated)));
+    WalletModel wallet_model(interfaces::MakeWallet(context, wallet), models.client);
+
+    {
+        // This wallet sent its details for bob's row and reserved one of its
+        // coins. The coin it came from is spent, which only this wallet can see.
+        CMutableTransaction parent_tx;
+        parent_tx.vin.emplace_back(COutPoint(uint256::ONE, 0));
+        parent_tx.vout.emplace_back(401 * COIN, GetScriptForDestination(PKHash(own_key.GetPubKey())));
+        QVERIFY(wallet->AddToWallet(MakeTransactionRef(parent_tx), wallet::TxStateInactive{}) != nullptr);
+        CMutableTransaction coin_tx;
+        coin_tx.vin.emplace_back(COutPoint(parent_tx.GetHash(), 0));
+        coin_tx.vout.emplace_back(400 * COIN, GetScriptForDestination(PKHash(own_key.GetPubKey())));
+        QVERIFY(wallet->AddToWallet(MakeTransactionRef(coin_tx), wallet::TxStateInactive{}) != nullptr);
+        const COutPoint coin{coin_tx.GetHash(), 0};
+
+        // The operator key is chosen before anybody is invited, so locking keeps the terms
+        CBLSSecretKey operator_secret;
+        operator_secret.MakeNewKey();
+        MnShareSession invitation{InvitationSession()};
+        invitation.terms().operatorPubKey = QString::fromStdString(
+            operator_secret.GetPublicKey().ToString(/*specificLegacyScheme=*/false));
+        const auto lock = [&](MnShareSession session) {
+            const PreparedRegistration prepared{PrepareRegistration(session, operator_secret)};
+            QString lock_error;
+            session.freeze(prepared.txHex, prepared.consentHashHex, prepared.collateralIndex, lock_error);
+            return session;
+        };
+        MnShareSession sent{invitation};
+        sent.shares()[1].ownerAddress = QString::fromStdString(EncodeDestination(PKHash(own_key.GetPubKey())));
+        sent.shares()[1].refundAddress = FreshP2PKHAddress();
+        MnShareSession::Contribution reserved;
+        reserved.label = sent.shares()[1].label;
+        reserved.inputs.push_back({QString::fromStdString(coin.hash.ToString()), coin.n});
+        reserved.hasChange = true;
+        reserved.changeAddress = sent.shares()[1].ownerAddress;
+        reserved.changeAmount = 50 * COIN;
+        QString error;
+        QVERIFY2(sent.addContribution(reserved, error), qPrintable(error));
+
+        SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+        dialog.openSharedMessage(invitation.toJsonString());
+        dialog.openSharedMessage(sent.toJsonString());
+        QCOMPARE(dialog.myShareIndex(), 1);
+        QCOMPARE(dialog.m_session.revision(), sent.revision());
+        dialog.goToPage(SharedMnCreateDialog::PageWaitTerms);
+        QVERIFY(wallet_model.wallet().isLockedCoin(coin));
+
+        // The invitation or this wallet's own reply pasted again changes nothing
+        for (const MnShareSession& again : {invitation, sent}) {
+            dialog.openSharedMessage(again.toJsonString());
+            QVERIFY2(dialog.m_error_label->text().isEmpty(), qPrintable(dialog.m_error_label->text()));
+            QCOMPARE(dialog.m_session.revision(), sent.revision());
+            QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageWaitTerms));
+        }
+
+        // The coordinator absorbs that reply or not, then edits the draft once,
+        // which bumps its revision by one, as reserving did here
+        MnShareSession absorbed{invitation};
+        QCOMPARE(int(absorbed.absorbDraftReply(sent, error)), int(MnShareSession::MergeResult::Merged));
+        const auto edited = [](MnShareSession session, const std::function<void(MnShareSession&)>& edit) {
+            edit(session);
+            session.noteDraftChange();
+            return session;
+        };
+        bool edits_applied{true};
+        const auto replace_contribution = [&](const MnShareSession::Contribution& replacement) {
+            return [&, replacement](MnShareSession& s) {
+                QString edit_error;
+                edits_applied &= s.removeContribution(replacement.label, edit_error) &&
+                                 s.addContribution(replacement, edit_error);
+            };
+        };
+        MnShareSession::Contribution skimmed{reserved};
+        skimmed.changeAmount -= 10 * COIN;
+        MnShareSession::Contribution spent_coin{reserved};
+        spent_coin.label = QStringLiteral("carol");
+        spent_coin.inputs = {{QString::fromStdString(parent_tx.GetHash().ToString()), 0}};
+        MnShareSession::Contribution second{skimmed};
+        second.label = QStringLiteral("bobx");
+        second.inputs = {{FakeTxid('9'), 0}};
+
+        // A newer draft that changes this wallet's amount, refund address, name or
+        // coins, with its reply absorbed or not, is refused and names the share
+        const auto more = [](MnShareSession& s) {
+            s.shares()[1].amount += COIN;
+            s.shares()[2].amount -= COIN;
+        };
+        const auto new_refund = [](MnShareSession& s) { s.shares()[1].refundAddress = FreshP2PKHAddress(); };
+        const auto renamed = [](MnShareSession& s) { s.shares()[1].label = QStringLiteral("bobby"); };
+        const auto carol_renamed = [](MnShareSession& s) { s.shares()[2].label = QStringLiteral("carol (renamed)"); };
+        const auto name_reused = [](MnShareSession& s) { s.shares()[2].label = QStringLiteral("bob"); };
+        const auto names_swapped = [](MnShareSession& s) { std::swap(s.shares()[1].label, s.shares()[2].label); };
+        // Changing only coins is a newer draft too once anything else changes
+        const auto skim = [&](MnShareSession& s) {
+            replace_contribution(skimmed)(s);
+            carol_renamed(s);
+        };
+        // Two contributions under bob's name, of which only the first would be used
+        const MnShareSession with_second{edited(absorbed, [&](MnShareSession& s) {
+            QString edit_error;
+            edits_applied &= s.addContribution(second, edit_error);
+            carol_renamed(s);
+        })};
+        QString twice_json{with_second.toJsonString()};
+        twice_json.replace(QStringLiteral("\"bobx\""), QStringLiteral("\"bob\""));
+        MnShareSession twice;
+        QVERIFY2(twice.fromJson(twice_json.toStdString(), error), qPrintable(error));
+        QCOMPARE(twice.contributions().size(), size_t{2});
+        for (const MnShareSession& changed :
+             {edited(absorbed, more), edited(absorbed, new_refund), edited(absorbed, renamed), edited(absorbed, skim),
+              edited(absorbed, name_reused), edited(absorbed, names_swapped), twice, edited(invitation, more)}) {
+            QVERIFY(edits_applied);
+            QVERIFY(changed.revision() >= sent.revision());
+            dialog.openSharedMessage(changed.toJsonString());
+            QVERIFY2(dialog.m_error_label->text().contains(QStringLiteral("changes your share (bob)")),
+                     qPrintable(dialog.m_error_label->text()));
+            QCOMPARE(dialog.m_session.revision(), sent.revision());
+            QVERIFY(dialog.m_session.hasShare(sent.shares()[1]));
+            QVERIFY(wallet_model.wallet().isLockedCoin(coin));
+        }
+
+        // A draft of another session, or one whose funding can never confirm, is
+        // not loaded either, and the reservation stays
+        MnShareSession foreign{InvitationSession()};
+        for (int i = 0; i <= sent.revision(); ++i) {
+            foreign.noteDraftChange();
+        }
+        const auto dead{edited(absorbed, [&](MnShareSession& s) {
+            QString edit_error;
+            edits_applied &= s.addContribution(spent_coin, edit_error);
+            carol_renamed(s);
+        })};
+        // Nor is one that gives an earlier row an owner from this wallet, which
+        // would become the share this wallet answers for
+        const auto other_own{wallet->GetNewDestination("")};
+        QVERIFY(other_own);
+        const auto takes_alice{edited(absorbed, [&](MnShareSession& s) {
+            s.shares()[0].ownerAddress = QString::fromStdString(EncodeDestination(*other_own));
+            carol_renamed(s);
+        })};
+        QVERIFY(edits_applied);
+        for (const auto& [refused, reason] :
+             {std::pair{foreign, QStringLiteral("different session")}, std::pair{dead, QStringLiteral("was spent")},
+              std::pair{takes_alice, QStringLiteral("gives alice's share an owner address from this wallet")}}) {
+            dialog.openSharedMessage(refused.toJsonString());
+            QVERIFY2(dialog.m_error_label->text().contains(reason), qPrintable(dialog.m_error_label->text()));
+            QCOMPARE(dialog.m_session.sessionId(), sent.sessionId());
+            QCOMPARE(dialog.m_session.revision(), sent.revision());
+            QCOMPARE(dialog.myShareIndex(), 1);
+            QVERIFY(wallet_model.wallet().isLockedCoin(coin));
+        }
+
+        // A newer draft that does not carry the reply yet loads with this wallet's
+        // addresses and reservation kept, so it can reply again
+        const MnShareSession unanswered{edited(invitation, carol_renamed)};
+        QCOMPARE(unanswered.revision(), sent.revision());
+        dialog.openSharedMessage(unanswered.toJsonString());
+        QVERIFY2(dialog.m_error_label->text().isEmpty(), qPrintable(dialog.m_error_label->text()));
+        QCOMPARE(dialog.m_session.shares()[2].label, QStringLiteral("carol (renamed)"));
+        QCOMPARE(dialog.myShareIndex(), 1);
+        QVERIFY(dialog.m_session.hasShare(sent.shares()[1]));
+        QVERIFY(dialog.m_session.hasContribution(reserved));
+        QVERIFY(wallet_model.wallet().isLockedCoin(coin));
+        QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageContribution));
+
+        // The reply carries the addresses and coins this wallet sent first, and
+        // the coordinator can absorb it
+        dialog.onNext();
+        QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageWaitTerms));
+        MnShareSession reply;
+        QVERIFY2(reply.fromJson(QApplication::clipboard()->text().toStdString(), error), qPrintable(error));
+        QVERIFY(reply.hasShare(sent.shares()[1]));
+        QVERIFY(reply.hasContribution(reserved));
+        MnShareSession coordinator{unanswered};
+        QCOMPARE(int(coordinator.absorbDraftReply(reply, error)), int(MnShareSession::MergeResult::Merged));
+        QVERIFY(coordinator.hasShare(sent.shares()[1]));
+        QVERIFY(coordinator.hasContribution(reserved));
+
+        // A newer draft that only edits another row loads, reservation and all,
+        // as does one that has lost this wallet's coins
+        const MnShareSession other_row{
+            edited(coordinator, [](MnShareSession& s) { s.shares()[2].label = QStringLiteral("carol"); })};
+        const MnShareSession uncounted{edited(other_row, [&](MnShareSession& s) {
+            QString edit_error;
+            edits_applied &= s.removeContribution(reserved.label, edit_error);
+        })};
+        QVERIFY(edits_applied);
+        for (const MnShareSession& loaded : {other_row, uncounted}) {
+            dialog.openSharedMessage(loaded.toJsonString());
+            QVERIFY2(dialog.m_error_label->text().isEmpty(), qPrintable(dialog.m_error_label->text()));
+            QCOMPARE(dialog.m_session.shares()[2].label, QStringLiteral("carol"));
+            QVERIFY(dialog.m_session.hasShare(sent.shares()[1]));
+            QVERIFY(dialog.m_session.hasContribution(reserved));
+            QVERIFY(wallet_model.wallet().isLockedCoin(coin));
+        }
+
+        // An invitation older than the one loaded is refused in the participant's terms
+        dialog.openSharedMessage(unanswered.toJsonString());
+        QVERIFY2(dialog.m_error_label->text().contains(QStringLiteral("older than the one you already have")),
+                 qPrintable(dialog.m_error_label->text()));
+        QCOMPARE(dialog.m_session.shares()[2].label, QStringLiteral("carol"));
+
+        // Locked terms are still held to the coins this wallet reserved: a copy
+        // that keeps back some of its change is refused, the honest one adopted
+        MnShareSession complete{other_row};
+        for (int i : {0, 2}) {
+            QCOMPARE(int(complete.absorbDraftReply(DraftReply(other_row, i, FakeTxid('1' + i)), error)),
+                     int(MnShareSession::MergeResult::Merged));
+        }
+        MnShareSession short_changed{complete};
+        replace_contribution(skimmed)(short_changed);
+        QVERIFY(edits_applied);
+        short_changed = lock(short_changed);
+        QCOMPARE(int(short_changed.stage()), int(MnShareSession::Stage::Frozen));
+        dialog.openSharedMessage(short_changed.toJsonString());
+        QVERIFY2(dialog.m_error_label->text().contains(QStringLiteral("do not contain the details you sent")),
+                 qPrintable(dialog.m_error_label->text()));
+        QCOMPARE(int(dialog.m_session.stage()), int(MnShareSession::Stage::Draft));
+
+        const MnShareSession locked{lock(complete)};
+        QCOMPARE(int(locked.stage()), int(MnShareSession::Stage::Frozen));
+        dialog.openSharedMessage(locked.toJsonString());
+        QVERIFY2(dialog.m_error_label->text().isEmpty(), qPrintable(dialog.m_error_label->text()));
+        QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageApprovals));
+        QVERIFY2(dialog.m_funding_refusal.isEmpty(), qPrintable(dialog.m_funding_refusal));
+
+        // A saved session reopened after releasing and reserving again carries a
+        // revision past the coordinator's next draft, which still loads
+        MnShareSession resaved{sent};
+        replace_contribution(reserved)(resaved);
+        QVERIFY(edits_applied);
+        QVERIFY(resaved.revision() > unanswered.revision());
+        SharedMnCreateDialog reopened(m_node, &wallet_model, /*parent=*/nullptr);
+        reopened.openSharedMessage(resaved.toJsonString());
+        QCOMPARE(reopened.myShareIndex(), 1);
+        reopened.openSharedMessage(unanswered.toJsonString());
+        QVERIFY2(reopened.m_error_label->text().isEmpty(), qPrintable(reopened.m_error_label->text()));
+        QCOMPARE(reopened.m_session.shares()[2].label, QStringLiteral("carol (renamed)"));
+        QVERIFY(reopened.m_session.hasContribution(reserved));
+        QVERIFY(wallet_model.wallet().isLockedCoin(coin));
+
+        // Releasing bob's row and reserving carol's instead leaves bob's
+        // addresses behind, so two rows have an owner from this wallet. A newer
+        // draft that keeps both still leaves carol as this wallet's share.
+        SharedMnCreateDialog moved(m_node, &wallet_model, /*parent=*/nullptr);
+        moved.openSharedMessage(invitation.toJsonString());
+        moved.openSharedMessage(sent.toJsonString());
+        QCOMPARE(moved.myShareIndex(), 1);
+        moved.releaseCoins();
+        QVERIFY(!wallet_model.wallet().isLockedCoin(coin));
+        moved.m_who_am_i_combo->setCurrentIndex(moved.m_who_am_i_combo->findData(2));
+        QCOMPARE(moved.myShareIndex(), 2);
+        // This coin is not one Reserve Coins can select, so record carol's
+        // reservation the way it does
+        const auto carol_owner{wallet->GetNewDestination("")};
+        QVERIFY(carol_owner);
+        auto& carol_row{moved.m_session.shares()[2]};
+        carol_row.ownerAddress = QString::fromStdString(EncodeDestination(*carol_owner));
+        carol_row.refundAddress = FreshP2PKHAddress();
+        MnShareSession::Contribution carols{reserved};
+        carols.label = carol_row.label;
+        carols.changeAddress = carol_row.ownerAddress;
+        carols.changeAmount = 150 * COIN;
+        QVERIFY2(moved.m_session.addContribution(carols, error), qPrintable(error));
+        moved.setContributionLocked(carols, /*lock=*/true);
+        moved.m_coins_released = false;
+        QVERIFY(!moved.m_session.shares()[1].ownerAddress.isEmpty());
+
+        const MnShareSession both_kept{
+            edited(moved.m_session, [](MnShareSession& s) { s.shares()[0].label = QStringLiteral("alice (renamed)"); })};
+        moved.openSharedMessage(both_kept.toJsonString());
+        QVERIFY2(moved.m_error_label->text().isEmpty(), qPrintable(moved.m_error_label->text()));
+        QCOMPARE(moved.m_session.shares()[0].label, QStringLiteral("alice (renamed)"));
+        QCOMPARE(moved.myShareIndex(), 2);
+        QVERIFY(moved.myContribution() != nullptr && moved.myContribution()->label == carols.label);
+        QVERIFY(wallet_model.wallet().isLockedCoin(coin));
+        // The reply repeats carol's details and reserves nothing for bob
+        moved.onNext();
+        QCOMPARE(int(moved.currentPage()), int(SharedMnCreateDialog::PageWaitTerms));
+        MnShareSession moved_reply;
+        QVERIFY2(moved_reply.fromJson(QApplication::clipboard()->text().toStdString(), error), qPrintable(error));
+        QVERIFY(moved_reply.hasContribution(carols));
+        QCOMPARE(moved_reply.contributions().size(), size_t{1});
+        QVERIFY(wallet_model.wallet().isLockedCoin(coin));
+        wallet_model.wallet().unlockCoin(coin);
+    }
+
+    // Locked terms in which bob's row is this wallet's
+    const MnShareSession invitation{InvitationSession()};
+    MnShareSession draft{invitation};
+    std::vector<CKey> owner_keys(3);
+    QString error;
+    for (int i = 0; i < 3; ++i) {
+        draft.absorbDraftReply(DraftReply(invitation, i, FakeTxid('1' + i), &owner_keys[i]), error);
+    }
+    owner_keys[1] = own_key;
+    draft.shares()[1].ownerAddress = QString::fromStdString(EncodeDestination(PKHash(own_key.GetPubKey())));
+    const MnShareSession frozen{FrozenSession(draft, owner_keys, /*sign_all=*/false)};
+    QCOMPARE(int(frozen.stage()), int(MnShareSession::Stage::Frozen));
+
+    // The same terms locked again as a newer revision, after `edit` changed them
+    const auto relocked = [&](const std::function<void(MnShareSession&)>& edit) {
+        MnShareSession session{frozen};
+        session.unfreeze();
+        edit(session);
+        return FrozenSession(session, owner_keys, /*sign_all=*/false);
+    };
+
+    SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+    dialog.openSharedMessage(frozen.toJsonString());
+    QCOMPARE(dialog.myShareIndex(), 1);
+    QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageApprovals));
+
+    // A newer revision that changes this wallet's refund, reward or owner address,
+    // or its amount, is not loaded
+    for (const auto& edit : std::vector<std::function<void(MnShareSession&)>>{
+             [](MnShareSession& s) { s.shares()[1].refundAddress = FreshP2PKHAddress(); },
+             [](MnShareSession& s) { s.shares()[1].rewardAddress = FreshP2PKHAddress(); },
+             [](MnShareSession& s) { s.shares()[1].ownerAddress = FreshP2PKHAddress(); },
+             [](MnShareSession& s) {
+                 s.shares()[1].amount += COIN;
+                 s.shares()[2].amount -= COIN;
+             }}) {
+        const MnShareSession edited{relocked(edit)};
+        QCOMPARE(int(edited.stage()), int(MnShareSession::Stage::Frozen));
+        QVERIFY(edited.revision() > frozen.revision());
+        dialog.openSharedMessage(edited.toJsonString());
+        QCOMPARE(dialog.m_session.revision(), frozen.revision());
+        QVERIFY(dialog.m_session.hasShare(frozen.shares()[1]));
+        QVERIFY(dialog.m_error_label->text().contains(QStringLiteral("changes your share")));
+
+        // A fingerprint warning on the same copy does not replace the refusal
+        UniValue mislabeled{edited.toJson()};
+        mislabeled.pushKV("fingerprint", "00000000");
+        dialog.openSharedMessage(QString::fromStdString(mislabeled.write()));
+        QCOMPARE(dialog.m_session.revision(), frozen.revision());
+        QVERIFY(dialog.m_error_label->text().contains(QStringLiteral("changes your share")));
+    }
+
+    // So is a newer unlocked draft that changes it
+    MnShareSession draft_edit{frozen};
+    draft_edit.unfreeze();
+    draft_edit.shares()[1].refundAddress = FreshP2PKHAddress();
+    QCOMPARE(int(draft_edit.stage()), int(MnShareSession::Stage::Draft));
+    QVERIFY(draft_edit.revision() > frozen.revision());
+    dialog.openSharedMessage(draft_edit.toJsonString());
+    QCOMPARE(dialog.m_session.revision(), frozen.revision());
+    QVERIFY(dialog.m_session.hasShare(frozen.shares()[1]));
+    QVERIFY(dialog.m_error_label->text().contains(QStringLiteral("changes your share")));
+
+    // A newer revision that only changes another participant's row is loaded, as
+    // is one where an earlier row was removed and this wallet's share moved up
+    const MnShareSession other_row{relocked([](MnShareSession& s) { s.shares()[2].rewardAddress = FreshP2PKHAddress(); })};
+    dialog.openSharedMessage(other_row.toJsonString());
+    QVERIFY2(dialog.m_error_label->text().isEmpty(), qPrintable(dialog.m_error_label->text()));
+    QCOMPARE(dialog.m_session.revision(), other_row.revision());
+    QCOMPARE(dialog.myShareIndex(), 1);
+
+    MnShareSession removed_row{dialog.m_session};
+    removed_row.unfreeze();
+    removed_row.shares()[2].amount += removed_row.shares()[0].amount;
+    removed_row.shares().erase(removed_row.shares().begin());
+    removed_row = FrozenSession(removed_row, {owner_keys[1], owner_keys[2]}, /*sign_all=*/false);
+    QCOMPARE(int(removed_row.stage()), int(MnShareSession::Stage::Frozen));
+    dialog.openSharedMessage(removed_row.toJsonString());
+    QVERIFY2(dialog.m_error_label->text().isEmpty(), qPrintable(dialog.m_error_label->text()));
+    QCOMPARE(dialog.m_session.revision(), removed_row.revision());
+    QCOMPARE(dialog.myShareIndex(), 0);
+}
+
 void SharedMnWizardTests::savingWaitsForTheOperatorKeyBackup()
 {
     TestingSetup test{CBaseChainParams::REGTEST};
@@ -825,6 +1615,174 @@ void SharedMnWizardTests::participantsPageGating()
     dialog.refreshShareTable();
     QVERIFY(!dialog.validatePage(SharedMnCreateDialog::PageParticipants, error));
     QVERIFY(!error.isEmpty());
+
+    // Coins reserved for this wallet's row were sized for its amount and are
+    // recorded under its name, so that row stays fixed until they are released;
+    // the other rows are still the coordinator's to edit
+    const auto name_cell = [&](int row) {
+        return qobject_cast<QLineEdit*>(dialog.m_share_table->cellWidget(row, SharedMnCreateDialog::SHARE_COL_NAME));
+    };
+    // BitcoinAmountField::setEnabled() reaches only the editor inside it
+    const auto amount_editable = [&](int row) {
+        return dialog.m_share_table->cellWidget(row, SharedMnCreateDialog::SHARE_COL_AMOUNT)->findChild<QLineEdit*>()->isEnabled();
+    };
+    MnShareSession::Contribution mine;
+    mine.label = dialog.m_session.shares()[0].label;
+    mine.inputs.push_back({.txid = FakeTxid('1')});
+    QVERIFY2(dialog.m_session.addContribution(mine, error), qPrintable(error));
+    dialog.refreshShareTable();
+    QVERIFY(!amount_editable(0));
+    QVERIFY(name_cell(0)->isReadOnly());
+    QVERIFY(amount_editable(1));
+    QVERIFY(!name_cell(1)->isReadOnly());
+    // Nor can the row be removed from under the reservation
+    dialog.m_share_table->setCurrentCell(0, SharedMnCreateDialog::SHARE_COL_NAME);
+    dialog.m_remove_share_button->click();
+    QCOMPARE(dialog.m_session.shares().size(), size_t{3});
+    QVERIFY(dialog.myContribution() != nullptr);
+    QVERIFY(!dialog.m_error_label->text().isEmpty());
+
+    dialog.releaseCoins();
+    QVERIFY(dialog.myContribution() == nullptr);
+    QVERIFY(amount_editable(0));
+    QVERIFY(!name_cell(0)->isReadOnly());
+}
+
+void SharedMnWizardTests::serviceAddressInUseIsRefused()
+{
+    // DIP3 is active at the tip, so the tip's masternode list is what the
+    // network checks a registration's service address against
+    TestChainSetup test{107, CBaseChainParams::REGTEST, {"-dip3params=109:500"}};
+    test.mineBlocks(2);
+    m_node.setContext(&test.m_node);
+    const CBlockIndex* const tip{WITH_LOCK(::cs_main, return test.m_node.chainman->ActiveChain().Tip())};
+    test.m_node.dmnman->UpdatedBlockTip(tip);
+
+    const QString port{QString::number(Params().GetDefaultPort())};
+    const QString in_use{QStringLiteral("1.2.3.4:") + port};
+    auto state{std::make_shared<CDeterministicMNState>()};
+    state->nVersion = ProTxVersion::BasicBLS;
+    state->netInfo = NetInfoInterface::MakeNetInfo(state->nVersion);
+    QCOMPARE(int(state->netInfo->AddEntry(NetInfoPurpose::CORE_P2P, in_use.toStdString())), int(NetInfoStatus::Success));
+    state->keyIDOwner = MasternodeTestUtil::TestKeyID(1);
+    state->keyIDVoting = state->keyIDOwner;
+    auto registered{std::make_shared<CDeterministicMN>(/*_internalId=*/0, MnType::Regular)};
+    registered->proTxHash = uint256::ONE;
+    registered->collateralOutpoint = COutPoint{uint256::ONE, 0};
+    registered->pdmnState = state;
+    CDeterministicMNList mn_list{tip->GetBlockHash(), tip->nHeight, /*_totalRegisteredCount=*/0};
+    mn_list.AddMN(registered);
+    test.m_node.dmnman->SetListForBlockForTesting(mn_list);
+
+    SharedMnCreateDialog dialog(m_node, /*wallet_model=*/nullptr, /*parent=*/nullptr);
+    dialog.m_role = SharedMnCreateDialog::Role::Coordinator;
+    dialog.m_session = InvitationSession();
+    dialog.m_my_share = 0;
+    dialog.rebuildOrder();
+    dialog.goToPage(SharedMnCreateDialog::PageSettings);
+    dialog.m_voting_edit->setText(dialog.m_session.terms().votingAddress);
+
+    QString error;
+    // No service yet stays allowed: the node is then set up by a later service update
+    dialog.m_service_edit->clear();
+    QVERIFY2(dialog.validatePage(SharedMnCreateDialog::PageSettings, error), qPrintable(error));
+    dialog.m_service_edit->setText(QStringLiteral("1.2.3.5:") + port);
+    QVERIFY2(dialog.validatePage(SharedMnCreateDialog::PageSettings, error), qPrintable(error));
+
+    // The registered masternode's address is refused here, while it is still
+    // free to change, rather than by the network at broadcast
+    dialog.m_service_edit->setText(in_use);
+    dialog.onNext();
+    QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageSettings));
+    QVERIFY2(dialog.m_error_label->text().contains(in_use), qPrintable(dialog.m_error_label->text()));
+
+    // A session that got past the settings page before the address was taken
+    // is refused at Lock, before anyone approves it
+    MnShareSession draft{dialog.m_session};
+    for (int i = 0; i < 3; ++i) {
+        QCOMPARE(int(draft.absorbDraftReply(DraftReply(dialog.m_session, i, FakeTxid('1' + i)), error)),
+                 int(MnShareSession::MergeResult::Merged));
+    }
+    draft.terms().coreP2PAddrs = in_use;
+    dialog.m_session = draft;
+    dialog.pushSessionToWidgets();
+    dialog.goToPage(SharedMnCreateDialog::PageInvite);
+    dialog.lockTerms();
+    QCOMPARE(int(dialog.m_session.stage()), int(MnShareSession::Stage::Draft));
+    QVERIFY2(dialog.m_error_label->text().contains(in_use), qPrintable(dialog.m_error_label->text()));
+}
+
+void SharedMnWizardTests::reusedRefundAddressIsRefusedBeforeReserving()
+{
+    TestingSetup test{CBaseChainParams::REGTEST};
+    m_node.setContext(&test.m_node);
+    WalletContext& context{*m_node.walletLoader().context()};
+
+    CKey my_key;
+    my_key.MakeNewKey(/*fCompressed=*/true);
+    const auto wallet{MakeSpendingWallet(m_node, context, "part", my_key)};
+    QVERIFY(wallet != nullptr);
+    WalletGuard guard{context, wallet};
+    MasternodeTestUtil::GuiModels models{m_node};
+    QVERIFY2(models.ok, qPrintable(QString::fromStdString(models.error.translated)));
+    WalletModel wallet_model(interfaces::MakeWallet(context, wallet), models.client);
+
+    // alice has answered for her row; this wallet takes bob's
+    const MnShareSession invitation{InvitationSession()};
+    MnShareSession claimed{invitation};
+    QString error;
+    QVERIFY(claimed.absorbDraftReply(DraftReply(invitation, 0, FakeTxid('1')), error) ==
+            MnShareSession::MergeResult::Merged);
+    const auto& alice{claimed.shares()[0]};
+    const QString owner{QString::fromStdString(EncodeDestination(PKHash(my_key.GetPubKey())))};
+
+    SharedMnCreateDialog dialog(m_node, &wallet_model, /*parent=*/nullptr);
+    dialog.handleImportedText(claimed.toJsonString());
+    QCOMPARE(int(dialog.currentPage()), int(SharedMnCreateDialog::PageContribution));
+    dialog.m_who_am_i_combo->setCurrentIndex(dialog.m_who_am_i_combo->findData(1));
+    QCOMPARE(dialog.myShareIndex(), 1);
+    dialog.m_owner_edit->setText(owner);
+    dialog.m_reward_edit->clear();
+
+    // Lock refuses a refund address that is the voting address, an owner
+    // address, or another share's refund address, so this page does too
+    for (const QString& refund : {owner, claimed.terms().votingAddress, alice.ownerAddress, alice.refundAddress}) {
+        dialog.m_refund_edit->setText(refund);
+        QVERIFY2(!dialog.validatePage(SharedMnCreateDialog::PageContribution, error), qPrintable(refund));
+        QVERIFY2(error.contains(QStringLiteral("refund")), qPrintable(error));
+
+        // The Reserve Coins button reaches the same refusal without Next
+        dialog.reserveCoins();
+        QVERIFY2(dialog.m_error_label->text().contains(QStringLiteral("refund")), qPrintable(dialog.m_error_label->text()));
+        QVERIFY(dialog.myContribution() == nullptr);
+        QVERIFY(dialog.m_session.shares()[1].refundAddress.isEmpty());
+    }
+
+    // A fresh refund address passes, with the reward left to default to it
+    dialog.m_refund_edit->setText(FreshP2PKHAddress());
+    QVERIFY2(dialog.validatePage(SharedMnCreateDialog::PageContribution, error), qPrintable(error));
+
+    // Lock also refuses an owner address that another share pays its refund or
+    // reward to, so neither Next nor Reserve Coins may get that far
+    for (const bool reward : {false, true}) {
+        MnShareSession paying_owner{claimed};
+        auto& other{paying_owner.shares()[0]};
+        (reward ? other.rewardAddress : other.refundAddress) = owner;
+        SharedMnCreateDialog reused(m_node, &wallet_model, /*parent=*/nullptr);
+        reused.handleImportedText(paying_owner.toJsonString());
+        reused.m_who_am_i_combo->setCurrentIndex(reused.m_who_am_i_combo->findData(1));
+        QCOMPARE(reused.myShareIndex(), 1);
+        reused.m_owner_edit->setText(owner);
+        reused.m_refund_edit->setText(FreshP2PKHAddress());
+        reused.m_reward_edit->clear();
+        QVERIFY(!reused.validatePage(SharedMnCreateDialog::PageContribution, error));
+        QVERIFY2(error.contains(QStringLiteral("owner address")), qPrintable(error));
+        reused.reserveCoins();
+        QVERIFY2(reused.m_error_label->text().contains(QStringLiteral("owner address")),
+                 qPrintable(reused.m_error_label->text()));
+        QVERIFY(reused.myContribution() == nullptr);
+        QVERIFY(reused.m_session.shares()[1].ownerAddress.isEmpty());
+    }
 }
 
 void SharedMnWizardTests::statusBoardAbsorbsRepliesInAnyOrder()
@@ -879,6 +1837,15 @@ void SharedMnWizardTests::statusBoardAbsorbsRepliesInAnyOrder()
     dialog.handleImportedText(DraftReply(invitation, 1, FakeTxid('4')).toJsonString());
     QVERIFY(dialog.m_error_label->text().contains(QStringLiteral("bob")));
     QCOMPARE(dialog.m_session.revision(), revision);
+
+    // A copy accepted after that refusal shows its own edit warning, not the
+    // earlier refusal
+    UniValue edited{bob.toJson()};
+    edited.pushKV("fingerprint", "0000-0000");
+    dialog.handleImportedText(QString::fromStdString(edited.write()));
+    QVERIFY2(dialog.m_error_label->text().isEmpty(), qPrintable(dialog.m_error_label->text()));
+    QVERIFY2(dialog.m_status_label->text().contains(QStringLiteral("edited after it was copied")),
+             qPrintable(dialog.m_status_label->text()));
 }
 
 void SharedMnWizardTests::pastedMessageRouting()
diff --git a/src/qt/test/sharedmnwizardtests.h b/src/qt/test/sharedmnwizardtests.h
index e3130f217928..7c96caad531f 100644
--- a/src/qt/test/sharedmnwizardtests.h
+++ b/src/qt/test/sharedmnwizardtests.h
@@ -30,12 +30,16 @@ private Q_SLOTS:
     void participantCannotChooseATakenShare();
     void coordinatorResumesSavedSession();
     void coordinatorResumesFullySignedSession();
+    void signedSessionReservation();
     void unauthorisedSignedInputsAreDetected();
     void refusesToSignCoinsOutsideOwnContribution();
     void refusesToSignShortChangedOwnContribution();
+    void newerRevisionKeepsOwnShare();
     void savingWaitsForTheOperatorKeyBackup();
     void coordinatorCanRetryOwnApproval();
     void participantsPageGating();
+    void serviceAddressInUseIsRefused();
+    void reusedRefundAddressIsRefusedBeforeReserving();
     void statusBoardAbsorbsRepliesInAnyOrder();
     void pastedMessageRouting();
     void copyPutsFingerprintedEnvelopeOnClipboard();
diff --git a/src/rpc/evo.cpp b/src/rpc/evo.cpp
index 662609baa303..70bec2280ec4 100644
--- a/src/rpc/evo.cpp
+++ b/src/rpc/evo.cpp
@@ -117,6 +117,8 @@ static RPCArg GetRpcArg(const std::string& strParamName)
                 "Array of addresses in the form \"ADDR:PORT\". Must be unique on the network.\n"
                 "A legacy ProTx can only store a single entry; storing multiple entries\n"
                 "requires upgrading to a version 3 ProTx.\n"
+                "The first entry must be IPv4 where masternodes require IPv4 (mainnet and, by default, regtest).\n"
+                "On mainnet, the first entry must use port 9999.\n"
                 "Can be set to an empty string, which will require a ProUpServTx afterwards.",
                 {
                     {"address", RPCArg::Type::STR, RPCArg::Optional::NO, ""},
@@ -127,7 +129,9 @@ static RPCArg GetRpcArg(const std::string& strParamName)
             {"coreP2PAddrs", RPCArg::Type::ARR, RPCArg::Optional::NO,
                 "Array of addresses in the form \"ADDR:PORT\". Must be unique on the network.\n"
                 "A legacy ProTx can only store a single entry; storing multiple entries\n"
-                "requires upgrading to a version 3 ProTx.",
+                "requires upgrading to a version 3 ProTx.\n"
+                "The first entry must be IPv4 where masternodes require IPv4 (mainnet and, by default, regtest).\n"
+                "On mainnet, the first entry must use port 9999.",
                 {
                     {"address", RPCArg::Type::STR, RPCArg::Optional::NO, ""},
                 },
@@ -247,6 +251,9 @@ static RPCArg GetRpcArg(const std::string& strParamName)
                 "Array of addresses in the form \"ADDR:PORT\" used by Platform for peer-to-peer connection.\n"
                 "For a legacy ProTx, pass a bare port number instead (e.g. 26656);\n"
                 "the \"ADDR:PORT\" / address-array form requires upgrading to a version 3 ProTx.\n"
+                "Where masternodes require IPv4 (mainnet and, by default, regtest), the first entry must use the\n"
+                "first coreP2PAddrs address.\n"
+                "On mainnet, the first entry must use port 26656.\n"
                 "Must be unique on the network. Can be set to an empty string, which will require a ProUpServTx afterwards.",
                 {
                     {"address", RPCArg::Type::STR, RPCArg::Optional::NO, ""},
@@ -258,6 +265,9 @@ static RPCArg GetRpcArg(const std::string& strParamName)
                 "Array of addresses in the form \"ADDR:PORT\" used by Platform for peer-to-peer connection.\n"
                 "For a legacy ProTx, pass a bare port number instead (e.g. 26656);\n"
                 "the \"ADDR:PORT\" / address-array form requires upgrading to a version 3 ProTx.\n"
+                "Where masternodes require IPv4 (mainnet and, by default, regtest), the first entry must use the\n"
+                "first coreP2PAddrs address.\n"
+                "On mainnet, the first entry must use port 26656.\n"
                 "Must be unique on the network.",
                 {
                     {"address", RPCArg::Type::STR, RPCArg::Optional::NO, ""},
@@ -269,6 +279,9 @@ static RPCArg GetRpcArg(const std::string& strParamName)
                 "Array of addresses in the form \"ADDR:PORT\" used by Platform for their HTTPS API.\n"
                 "For a legacy ProTx, pass a bare port number instead (e.g. 443);\n"
                 "the \"ADDR:PORT\" / address-array form requires upgrading to a version 3 ProTx.\n"
+                "Where masternodes require IPv4 (mainnet and, by default, regtest), the first entry must use the\n"
+                "first coreP2PAddrs address.\n"
+                "On mainnet, the first entry must use port 443.\n"
                 "Must be unique on the network. Can be set to an empty string, which will require a ProUpServTx afterwards.",
                 {
                     {"address", RPCArg::Type::STR, RPCArg::Optional::NO, ""},
@@ -280,6 +293,9 @@ static RPCArg GetRpcArg(const std::string& strParamName)
                 "Array of addresses in the form \"ADDR:PORT\" used by Platform for their HTTPS API.\n"
                 "For a legacy ProTx, pass a bare port number instead (e.g. 443);\n"
                 "the \"ADDR:PORT\" / address-array form requires upgrading to a version 3 ProTx.\n"
+                "Where masternodes require IPv4 (mainnet and, by default, regtest), the first entry must use the\n"
+                "first coreP2PAddrs address.\n"
+                "On mainnet, the first entry must use port 443.\n"
                 "Must be unique on the network.",
                 {
                     {"address", RPCArg::Type::STR, RPCArg::Optional::NO, ""},
@@ -1232,6 +1248,8 @@ static RPCHelpMan protx_shared_sign()
         "itself is not modified; pass the signatures to \"protx shared_combine\".\n"
         "Only the multi-party flows pass through here: a unilateral dissolution is built, signed and\n"
         "submitted in one step by \"protx shared_dissolve\" and never needs shared_sign.\n"
+        "A dissolution is signed only when it returns every share's principal to its refund address, less\n"
+        "the fee from the actor's share, as \"protx shared_dissolve_prepare\" builds it.\n"
         + HELP_REQUIRING_PASSPHRASE,
         {
             {"tx", RPCArg::Type::STR_HEX, RPCArg::Optional::NO, "The serialized transaction in hex format."},
diff --git a/src/test/baseindex_tests.cpp b/src/test/baseindex_tests.cpp
new file mode 100644
index 000000000000..bf3117554bf4
--- /dev/null
+++ b/src/test/baseindex_tests.cpp
@@ -0,0 +1,328 @@
+// Copyright (c) 2020-present The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <chain.h>
+#include <consensus/validation.h>
+#include <index/coinstatsindex.h>
+#include <interfaces/chain.h>
+#include <node/blockstorage.h>
+#include <script/script.h>
+#include <test/util/index.h>
+#include <test/util/setup_common.h>
+#include <util/check.h>
+#include <util/system.h>
+#include <validation.h>
+#include <validationinterface.h>
+
+#include <boost/test/unit_test.hpp>
+
+#include <memory>
+#include <optional>
+#include <vector>
+
+namespace {
+//! A minimal index that, like Dash's address and spent indexes, keeps one entry per block and erases the entries of
+//! rewound blocks in CustomRewind() block by block. The rewind is exposed, and can stop after a given block, so a test
+//! can leave the on-disk state that an unclean shutdown in the middle of a reorg would leave, without having to time
+//! an actual crash.
+class ErasingIndex final : public BaseIndex
+{
+    const std::unique_ptr<BaseIndex::DB> m_db;
+    const CBlockIndex* m_stop_after{nullptr};
+
+public:
+    explicit ErasingIndex(std::unique_ptr<interfaces::Chain> chain)
+        : BaseIndex(std::move(chain), "erasing test index"),
+          m_db{std::make_unique<BaseIndex::DB>(gArgs.GetDataDirNet() / "indexes" / "erasingtest", /*n_cache_size=*/1 << 20)}
+    {
+    }
+    ~ErasingIndex() override
+    {
+        Interrupt();
+        Stop();
+    }
+
+    bool Indexed(const CBlockIndex* block) const { return Indexed(block->GetBlockHash()); }
+    bool Indexed(const uint256& block_hash) const { return m_db->Exists(std::make_pair(uint8_t{'e'}, block_hash)); }
+    //! Write the entry CustomAppend() writes, for a block the block index doesn't have
+    void WriteEntry(const uint256& block_hash)
+    {
+        BOOST_REQUIRE(m_db->Write(std::make_pair(uint8_t{'e'}, block_hash), true));
+    }
+    //! Rewind, or with stop_after set, stop as a crash would once that block's batch is written
+    bool RewindTo(const CBlockIndex* current_tip, const CBlockIndex* new_tip, const CBlockIndex* stop_after = nullptr)
+    {
+        m_stop_after = stop_after;
+        const bool ok{CustomRewind({current_tip->GetBlockHash(), current_tip->nHeight}, {new_tip->GetBlockHash(), new_tip->nHeight})};
+        m_stop_after = nullptr;
+        return ok;
+    }
+    std::optional<uint256> UncommittedTip() const { return m_db->ReadUncommittedTip(); }
+    void SetUncommittedTip(const uint256& block_hash)
+    {
+        CDBBatch batch(*m_db);
+        m_db->WriteUncommittedTip(batch, block_hash);
+        m_db->WriteBatch(batch);
+    }
+    uint256 CommittedTip() const
+    {
+        const auto locator{m_db->ReadBestBlock()};
+        BOOST_REQUIRE(!locator.IsNull());
+        return locator.vHave.front();
+    }
+
+protected:
+    bool CustomAppend(const interfaces::BlockInfo& block) override { return m_db->Write(std::make_pair(uint8_t{'e'}, block.hash), true); }
+    bool CustomRewind(const interfaces::BlockKey& current_tip, const interfaces::BlockKey& new_tip) override
+    {
+        const CBlockIndex* current_tip_index{WITH_LOCK(::cs_main, return m_chainstate->m_blockman.LookupBlockIndex(current_tip.hash))};
+        const CBlockIndex* new_tip_index{WITH_LOCK(::cs_main, return m_chainstate->m_blockman.LookupBlockIndex(new_tip.hash))};
+        return RewindBlockByBlock(current_tip_index, new_tip_index, [&](const CBlockIndex* pindex, CDBBatch& batch) {
+            if (m_stop_after && pindex == m_stop_after->pprev) return false;
+            batch.Erase(std::make_pair(uint8_t{'e'}, pindex->GetBlockHash()));
+            return true;
+        });
+    }
+    BaseIndex::DB& GetDB() const override { return *m_db; }
+    bool AllowPrune() const override { return true; }
+    bool WritesEagerly() const override { return true; }
+};
+
+const CBlockIndex* AtHeight(ChainstateManager& chainman, int height)
+{
+    return WITH_LOCK(::cs_main, return chainman.ActiveChain()[height]);
+}
+
+//! Make `height` the chainstate's last flushed block while the tip stays above it: flush with the blocks above
+//! disconnected, then connect them again without a flush.
+void LowerLastFlushedBlock(ChainstateManager& chainman, int height)
+{
+    Chainstate& chainstate{chainman.ActiveChainstate()};
+    CBlockIndex* first_disconnected{WITH_LOCK(::cs_main, return chainman.ActiveChain()[height + 1])};
+    BlockValidationState state;
+    BOOST_REQUIRE(chainstate.InvalidateBlock(state, first_disconnected));
+    chainstate.ForceFlushStateToDisk();
+    WITH_LOCK(::cs_main, chainstate.ResetBlockFailureFlags(first_disconnected));
+    BOOST_REQUIRE(chainstate.ActivateBestChain(state));
+    BOOST_REQUIRE_EQUAL(WITH_LOCK(::cs_main, return chainstate.GetLastFlushedBlock()->nHeight), height);
+}
+} // namespace
+
+// Tests of generic BaseIndex functionality that is independent of which
+// concrete index is being used. CoinStatsIndex is used here merely as a
+// convenient instantiation of BaseIndex.
+BOOST_AUTO_TEST_SUITE(baseindex_tests)
+
+// Test that the index does not commit ahead of the chainstate's last
+// flushed block. If it did, a subsequent unclean shutdown would corrupt
+// the index, because during reverting it would require blocks that were
+// never flushed to disk.
+BOOST_FIXTURE_TEST_CASE(baseindex_no_commit_ahead_of_flush, TestChain100Setup)
+{
+    Chainstate& chainstate = Assert(m_node.chainman)->ActiveChainstate();
+    auto sync_index = [&](bool do_flush, int expected_sync_height, int expected_commit_height) {
+        {
+            CoinStatsIndex index{interfaces::MakeChain(m_node), /*n_cache_size=*/1 << 20};
+            BOOST_REQUIRE(index.Start());
+            IndexWaitSynced(index);
+            if (do_flush) {
+                chainstate.ForceFlushStateToDisk();
+                SyncWithValidationInterfaceQueue();
+            }
+            BOOST_CHECK_EQUAL(index.GetSummary().best_block_height, expected_sync_height);
+            index.Stop();
+        }
+        // Reload index to see which block data was actually committed. Init() and Sync() are not
+        // callable on their own in Dash, so hold back the sync thread while the loaded best block is read.
+        node::g_indexes_ready_to_sync = false;
+        {
+            CoinStatsIndex index{interfaces::MakeChain(m_node), /*n_cache_size=*/1 << 20};
+            BOOST_REQUIRE(index.Start());
+            BOOST_CHECK_EQUAL(index.GetSummary().best_block_height, expected_commit_height);
+            index.Interrupt();
+            index.Stop();
+        }
+        node::g_indexes_ready_to_sync = true;
+    };
+
+    // Part 1: Sync, then "crash" (stop without flushing). Models a node that
+    // started up, had its index catch up, but never flushed before going down.
+    // The end-of-sync Commit() runs at chain tip (height 100) but
+    // m_last_flushed_block is null, so it is skipped.
+    sync_index(false, 100, 0);
+
+    // Part 2: Restart cleanly. Sync, force a chainstate flush, and drain the
+    // validation queue so the index's ChainStateFlushed callback runs.
+    // Now m_last_flushed_block == tip == 100 and the index can commit.
+    sync_index(true, 100, 100);
+
+    // Part 3: Connect a new block on the chain without flushing
+    // (m_last_flushed_block stays at 100). For a real node this would happen
+    // in parallel with Sync(). Here we do it before Sync() to make the race
+    // state deterministic.
+    CreateAndProcessBlock({}, CScript() << OP_TRUE);
+    sync_index(false, 101, 100);
+}
+
+// A rewind persists its erasures right away. If the node then stops before the rewound tip is flushed and the
+// rewound blocks are back on the active chain, the next start must index them again instead of resuming above them.
+BOOST_FIXTURE_TEST_CASE(restart_after_rewind_reindexes_erased_blocks, TestChain100Setup)
+{
+    ChainstateManager& chainman{*Assert(m_node.chainman)};
+    {
+        ErasingIndex index{interfaces::MakeChain(m_node)};
+        BOOST_REQUIRE(index.Start());
+        IndexWaitSynced(index);
+        chainman.ActiveChainstate().ForceFlushStateToDisk();
+        SyncWithValidationInterfaceQueue();
+        index.Stop();
+    }
+    // The rewind target (97) is now above the last flush (95), so Commit() cannot persist it
+    LowerLastFlushedBlock(chainman, 95);
+    const CBlockIndex* tip{AtHeight(chainman, 100)};
+
+    node::g_indexes_ready_to_sync = false;
+    {
+        ErasingIndex index{interfaces::MakeChain(m_node)};
+        BOOST_REQUIRE(index.Start());
+        BOOST_CHECK(index.CommittedTip() == tip->GetBlockHash());
+        BOOST_REQUIRE(index.RewindTo(tip, AtHeight(chainman, 97)));
+        BOOST_CHECK(!index.Indexed(tip));
+        BOOST_CHECK(index.CommittedTip() == AtHeight(chainman, 97)->GetBlockHash());
+        index.Interrupt();
+        index.Stop();
+    }
+    node::g_indexes_ready_to_sync = true;
+
+    // The rewound blocks are still the active chain, as after a restart in which their branch wins again
+    ErasingIndex index{interfaces::MakeChain(m_node)};
+    BOOST_REQUIRE(index.Start());
+    IndexWaitSynced(index);
+    for (int height{98}; height <= 100; ++height) {
+        BOOST_CHECK_MESSAGE(index.Indexed(AtHeight(chainman, height)), "block " << height << " was not indexed again");
+    }
+    index.Stop();
+}
+
+// Each block's erasures are written in one batch with a locator at its parent. A node that stops in the middle of a
+// rewind then resumes from the last block whose entries are still there, and indexes the erased ones again.
+BOOST_FIXTURE_TEST_CASE(interrupted_rewind_keeps_locator_below_erased_entries, TestChain100Setup)
+{
+    ChainstateManager& chainman{*Assert(m_node.chainman)};
+    {
+        ErasingIndex index{interfaces::MakeChain(m_node)};
+        BOOST_REQUIRE(index.Start());
+        IndexWaitSynced(index);
+        chainman.ActiveChainstate().ForceFlushStateToDisk();
+        SyncWithValidationInterfaceQueue();
+        index.Stop();
+    }
+    const CBlockIndex* tip{AtHeight(chainman, 100)};
+
+    node::g_indexes_ready_to_sync = false;
+    {
+        ErasingIndex index{interfaces::MakeChain(m_node)};
+        BOOST_REQUIRE(index.Start());
+        BOOST_CHECK(index.CommittedTip() == tip->GetBlockHash());
+        BOOST_CHECK(!index.RewindTo(tip, AtHeight(chainman, 97), /*stop_after=*/tip));
+        BOOST_CHECK(!index.Indexed(tip));
+        BOOST_CHECK(index.Indexed(AtHeight(chainman, 99)));
+        BOOST_CHECK(index.CommittedTip() == AtHeight(chainman, 99)->GetBlockHash());
+        index.Interrupt();
+        index.Stop();
+    }
+    node::g_indexes_ready_to_sync = true;
+
+    ErasingIndex index{interfaces::MakeChain(m_node)};
+    BOOST_REQUIRE(index.Start());
+    IndexWaitSynced(index);
+    BOOST_CHECK_MESSAGE(index.Indexed(tip), "block 100 was not indexed again");
+    index.Stop();
+}
+
+// A sync that ends above the last flush can't commit its locator, but its entries are on disk. If those blocks leave
+// the active chain while the index is off, the next start must rewind them from the tip the sync reached.
+BOOST_FIXTURE_TEST_CASE(restart_rewinds_blocks_synced_above_flush, TestChain100Setup)
+{
+    ChainstateManager& chainman{*Assert(m_node.chainman)};
+    LowerLastFlushedBlock(chainman, 97);
+    const std::vector<const CBlockIndex*> orphaned{AtHeight(chainman, 98), AtHeight(chainman, 99), AtHeight(chainman, 100)};
+    {
+        ErasingIndex index{interfaces::MakeChain(m_node)};
+        BOOST_REQUIRE(index.Start());
+        IndexWaitSynced(index);
+        BOOST_CHECK(index.UncommittedTip() == orphaned.back()->GetBlockHash());
+        index.Stop();
+    }
+
+    // A rewind that stops after its first block moves the uncommitted tip down with it, so the next start, with the
+    // rewound block still on the active chain, indexes it again
+    node::g_indexes_ready_to_sync = false;
+    {
+        ErasingIndex index{interfaces::MakeChain(m_node)};
+        BOOST_REQUIRE(index.Start());
+        BOOST_CHECK(!index.RewindTo(orphaned.back(), AtHeight(chainman, 97), /*stop_after=*/orphaned.back()));
+        BOOST_CHECK(index.UncommittedTip() == orphaned[1]->GetBlockHash());
+        index.Interrupt();
+        index.Stop();
+    }
+    node::g_indexes_ready_to_sync = true;
+    {
+        ErasingIndex index{interfaces::MakeChain(m_node)};
+        BOOST_REQUIRE(index.Start());
+        IndexWaitSynced(index);
+        BOOST_CHECK(index.Indexed(orphaned.back()));
+        index.Stop();
+    }
+
+    // The reorged-away blocks stay in the block index, as after a periodic write before an unclean stop
+    BlockValidationState state;
+    BOOST_REQUIRE(chainman.ActiveChainstate().InvalidateBlock(state, WITH_LOCK(::cs_main, return chainman.ActiveChain()[98])));
+    for (int i{0}; i < 4; ++i) CreateAndProcessBlock({}, CScript() << OP_TRUE);
+
+    {
+        ErasingIndex index{interfaces::MakeChain(m_node)};
+        BOOST_REQUIRE(index.Start());
+        IndexWaitSynced(index);
+        for (const CBlockIndex* block : orphaned) {
+            BOOST_CHECK_MESSAGE(!index.Indexed(block), "orphaned block " << block->nHeight << " is still indexed");
+        }
+        for (int height{98}; height <= 101; ++height) {
+            BOOST_CHECK(index.Indexed(AtHeight(chainman, height)));
+        }
+        chainman.ActiveChainstate().ForceFlushStateToDisk();
+        SyncWithValidationInterfaceQueue();
+        BOOST_CHECK(!index.UncommittedTip());
+        index.Stop();
+    }
+
+    // An uncommitted tip that isn't above the locator was left behind by an older binary: it is dropped and the index
+    // starts from the locator
+    node::g_indexes_ready_to_sync = false;
+    {
+        ErasingIndex index{interfaces::MakeChain(m_node)};
+        index.SetUncommittedTip(orphaned.back()->GetBlockHash());
+        BOOST_REQUIRE(index.Start());
+        BOOST_CHECK_EQUAL(index.GetSummary().best_block_height, 101);
+        BOOST_CHECK(!index.UncommittedTip());
+        index.Interrupt();
+        index.Stop();
+    }
+
+    // An unclean stop can lose blocks the index already wrote entries for from the block index. Startup can't rewind
+    // those entries, so it must fail rather than resume from the locator with them in place.
+    const CBlock lost_block{CreateBlock({}, CScript() << OP_TRUE, chainman.ActiveChainstate())};
+    BOOST_REQUIRE(!WITH_LOCK(::cs_main, return chainman.m_blockman.LookupBlockIndex(lost_block.GetHash())));
+    {
+        ErasingIndex index{interfaces::MakeChain(m_node)};
+        index.WriteEntry(lost_block.GetHash());
+        index.SetUncommittedTip(lost_block.GetHash());
+        BOOST_CHECK(!index.Start());
+        BOOST_CHECK(index.UncommittedTip() == lost_block.GetHash());
+        BOOST_CHECK(index.Indexed(lost_block.GetHash()));
+    }
+    node::g_indexes_ready_to_sync = true;
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/blockfilter_index_tests.cpp b/src/test/blockfilter_index_tests.cpp
index 1a8612eb1c64..ba5db2a09f0c 100644
--- a/src/test/blockfilter_index_tests.cpp
+++ b/src/test/blockfilter_index_tests.cpp
@@ -17,6 +17,7 @@
 #include <validation.h>
 
 #include <boost/test/unit_test.hpp>
+#include <future>
 
 using node::BlockAssembler;
 using node::CBlockTemplate;
@@ -304,4 +305,80 @@ BOOST_FIXTURE_TEST_CASE(blockfilter_index_init_destroy, BasicTestingSetup)
     BOOST_CHECK(filter_index == nullptr);
 }
 
+class IndexReorgCrash : public BaseIndex
+{
+private:
+    std::unique_ptr<BaseIndex::DB> m_db;
+    std::shared_future<void> m_blocker;
+    int m_blocking_height;
+
+public:
+    explicit IndexReorgCrash(std::unique_ptr<interfaces::Chain> chain, std::shared_future<void> blocker,
+                             int blocking_height) : BaseIndex(std::move(chain), "test index"), m_blocker(blocker),
+                                                    m_blocking_height(blocking_height)
+    {
+        const fs::path path = gArgs.GetDataDirNet() / "index";
+        fs::create_directories(path);
+        m_db = std::make_unique<BaseIndex::DB>(path / "db", /*n_cache_size=*/0, /*f_memory=*/true, /*f_wipe=*/false);
+    }
+
+    bool AllowPrune() const override { return false; }
+    BaseIndex::DB& GetDB() const override { return *m_db; }
+
+    bool CustomAppend(const interfaces::BlockInfo& block) override
+    {
+        // Simulate a delay so new blocks can get connected during the initial sync
+        if (block.height == m_blocking_height) m_blocker.wait();
+
+        // Move mock time forward so the best index gets updated only when we are not at the blocking height
+        if (block.height == m_blocking_height - 1 || block.height > m_blocking_height) {
+            SetMockTime(GetTime<std::chrono::seconds>() + 31s);
+        }
+
+        return true;
+    }
+};
+
+BOOST_FIXTURE_TEST_CASE(index_reorg_crash, BuildChainTestingSetup)
+{
+    // Enable mock time
+    SetMockTime(GetTime<std::chrono::minutes>());
+
+    std::promise<void> promise;
+    std::shared_future<void> blocker(promise.get_future());
+    int blocking_height = WITH_LOCK(cs_main, return m_node.chainman->ActiveChain().Tip()->nHeight);
+
+    IndexReorgCrash index(interfaces::MakeChain(m_node), blocker, blocking_height);
+    BOOST_REQUIRE(index.Start());
+
+    auto func_wait_until = [&](int height, std::chrono::milliseconds timeout) {
+        auto deadline = std::chrono::steady_clock::now() + timeout;
+        while (index.GetSummary().best_block_height < height) {
+            if (std::chrono::steady_clock::now() > deadline) {
+                BOOST_FAIL(strprintf("Timeout waiting for index height %d (current: %d)", height, index.GetSummary().best_block_height));
+                return;
+            }
+            std::this_thread::sleep_for(100ms);
+        }
+    };
+
+    // Wait until the index is one block before the fork point
+    func_wait_until(blocking_height - 1, /*timeout=*/5s);
+
+    // Create a fork to trigger the reorg
+    std::vector<std::shared_ptr<CBlock>> fork;
+    const CBlockIndex* prev_tip = WITH_LOCK(cs_main, return m_node.chainman->ActiveChain().Tip()->pprev);
+    BOOST_REQUIRE(BuildChain(prev_tip, GetScriptForDestination(PKHash(GenerateRandomKey().GetPubKey())), 3, fork));
+
+    for (const auto& block : fork) {
+        BOOST_REQUIRE(m_node.chainman->ProcessNewBlock(block, /*force_processing=*/true, nullptr));
+    }
+
+    // Unblock the index thread so it can process the reorg
+    promise.set_value();
+    // Wait for the index to reach the new tip
+    func_wait_until(blocking_height + 2, 5s);
+    index.Stop();
+}
+
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/evo_deterministicmns_tests.cpp b/src/test/evo_deterministicmns_tests.cpp
index 40c62cb5f6b6..d0b4f5a8f9c3 100644
--- a/src/test/evo_deterministicmns_tests.cpp
+++ b/src/test/evo_deterministicmns_tests.cpp
@@ -1198,7 +1198,7 @@ void FuncProUpServInvalidNType(TestChainSetup& setup)
         {
             LOCK(cs_main);
             BOOST_CHECK(!CheckProUpServTx(CTransaction(tx), tip_index(), dmnman, chainman.GetConsensus(),
-                                          IsV24Active(chainman), check_state, /*check_sigs=*/true));
+                                          TipRules(chainman), check_state, /*check_sigs=*/true));
         }
         BOOST_CHECK_EQUAL(check_state.GetRejectReason(), "bad-protx-type");
 
@@ -1224,7 +1224,7 @@ void FuncProUpServInvalidNType(TestChainSetup& setup)
         {
             LOCK(cs_main);
             BOOST_CHECK(!CheckProUpServTx(CTransaction(tx), tip_index(), dmnman, chainman.GetConsensus(),
-                                          IsV24Active(chainman), check_state, /*check_sigs=*/true));
+                                          TipRules(chainman), check_state, /*check_sigs=*/true));
         }
         BOOST_CHECK_EQUAL(check_state.GetRejectReason(), "bad-protx-type-mismatch");
         BOOST_CHECK(check_state.GetResult() == TxValidationResult::TX_CONSENSUS);
@@ -1266,7 +1266,7 @@ void FuncProUpServInvalidNType(TestChainSetup& setup)
         {
             LOCK(cs_main);
             BOOST_CHECK_MESSAGE(CheckProUpServTx(CTransaction(tx), tip_index(), dmnman, chainman.GetConsensus(),
-                                                 IsV24Active(chainman), check_state,
+                                                 TipRules(chainman), check_state,
                                                  /*check_sigs=*/true),
                                 "unexpected rejection: " << check_state.GetRejectReason());
         }
@@ -2704,7 +2704,7 @@ void FuncMigrationRejectedWhenKeySquatted(TestChainV24SignalBeforeV19Setup& setu
         TxValidationState st;
         LOCK(cs_main);
         BOOST_CHECK(!CheckProUpServTx(CTransaction(tx), chainman.ActiveChain().Tip(), dmnman, chainman.GetConsensus(),
-                                      IsV24Active(chainman), st, true));
+                                      TipRules(chainman), st, true));
         BOOST_CHECK_EQUAL(st.GetRejectReason(), "bad-protx-dup-key");
     }
 
@@ -2760,7 +2760,7 @@ void FuncProUpServTxMigratesLegacy(TestChainV24SignalBeforeV19Setup& setup)
         TxValidationState val_state;
         LOCK(cs_main);
         BOOST_REQUIRE_MESSAGE(CheckProUpServTx(CTransaction(tx), chainman.ActiveChain().Tip(), dmnman,
-                                               chainman.GetConsensus(), IsV24Active(chainman), val_state,
+                                               chainman.GetConsensus(), TipRules(chainman), val_state,
                                                /*check_sigs=*/true),
                               "migration ProUpServTx rejected: " << val_state.GetRejectReason());
     }
@@ -3062,7 +3062,7 @@ void FuncEvoNodeRaisedToExtAddrByServiceUpdateOnly(TestChainV24SignalBeforeV19Se
         TxValidationState val_state;
         LOCK(cs_main);
         CheckProUpServTx(CTransaction(tx), chainman.ActiveChain().Tip(), dmnman, chainman.GetConsensus(),
-                         IsV24Active(chainman), val_state, /*check_sigs=*/true);
+                         TipRules(chainman), val_state, /*check_sigs=*/true);
         return val_state.GetRejectReason();
     };
     auto check_state = [&](uint16_t version, const std::string& what) {
@@ -3998,7 +3998,8 @@ void FuncPreV24BehaviourUnchanged(TestChainSetup& setup)
         TxValidationState val_state;
         LOCK(cs_main);
         BOOST_CHECK_MESSAGE(CheckProUpServTx(CTransaction(tx_ups), chainman.ActiveChain().Tip(), dmnman,
-                                             chainman.GetConsensus(), IsV24Active(chainman), val_state, /*check_sigs=*/true),
+                                             chainman.GetConsensus(), TipRules(chainman), val_state,
+                                             /*check_sigs=*/true),
                             "pre-v24 v2 ProUpServTx wrongly rejected: " << val_state.GetRejectReason());
     }
     setup.CreateAndProcessBlock({tx_ups}, coinbase_pk);
diff --git a/src/test/evo_netinfo_tests.cpp b/src/test/evo_netinfo_tests.cpp
index 3fc8e2d97f37..501ee4cf6831 100644
--- a/src/test/evo_netinfo_tests.cpp
+++ b/src/test/evo_netinfo_tests.cpp
@@ -5,15 +5,19 @@
 #include <test/util/setup_common.h>
 
 #include <evo/netinfo.h>
+#include <evo/providertx.h>
 #include <evo/types.h>
 #include <interfaces/node.h>
 #include <util/helpers.h>
 
 #include <chainparams.h>
+#include <consensus/validation.h>
+#include <deploymentstatus.h>
 #include <clientversion.h>
 #include <netbase.h>
 #include <streams.h>
 #include <util/strencodings.h>
+#include <util/string.h>
 
 #include <boost/test/unit_test.hpp>
 
@@ -103,19 +107,30 @@ void TestMnNetInfo(const std::vector<TestEntry>& vals)
 
 void TestExtNetInfo(const std::vector<TestEntry>& vals)
 {
+    // Mainnet has fixed rules for the first entry of each purpose (see provider_network_fields_main), so
+    // there the table checks the rules for additional entries, added behind valid primaries
+    const bool add_primaries{IsNodeOnMainnet()};
+    const size_t primaries_count{add_primaries ? 3U : 0U};
     for (const auto& [input, _, expected_ret] : vals) {
         const auto& [purpose, addr] = input;
         ExtNetInfo netInfo;
+        if (add_primaries) {
+            for (const auto& [primary_purpose, primary] : {std::pair{NetInfoPurpose::CORE_P2P, "1.2.3.4:9999"},
+                                                           std::pair{NetInfoPurpose::PLATFORM_P2P, "1.2.3.4:26656"},
+                                                           std::pair{NetInfoPurpose::PLATFORM_HTTPS, "1.2.3.4:443"}}) {
+                BOOST_REQUIRE_EQUAL(netInfo.AddEntry(primary_purpose, primary), NetInfoStatus::Success);
+            }
+        }
         BOOST_CHECK_EQUAL(netInfo.AddEntry(purpose, addr), expected_ret);
         if (expected_ret != NetInfoStatus::Success) {
             // An empty ExtNetInfo is considered malformed
-            BOOST_CHECK_EQUAL(netInfo.Validate(), NetInfoStatus::Malformed);
-            BOOST_CHECK(!netInfo.HasEntries(purpose));
-            BOOST_CHECK(netInfo.GetEntries().empty());
+            BOOST_CHECK_EQUAL(netInfo.Validate(), add_primaries ? NetInfoStatus::Success : NetInfoStatus::Malformed);
+            BOOST_CHECK_EQUAL(netInfo.HasEntries(purpose), add_primaries && IsValidPurpose(purpose));
+            BOOST_CHECK_EQUAL(netInfo.GetEntries().size(), primaries_count);
         } else {
             BOOST_CHECK_EQUAL(netInfo.Validate(), NetInfoStatus::Success);
             BOOST_CHECK(netInfo.HasEntries(purpose));
-            ValidateGetEntries(netInfo.GetEntries(), /*expected_size=*/1);
+            ValidateGetEntries(netInfo.GetEntries(), /*expected_size=*/primaries_count + 1);
         }
     }
 }
@@ -164,25 +179,27 @@ BOOST_AUTO_TEST_CASE(provider_network_fields_main)
         .platform_p2p = MainParams().GetDefaultPlatformP2PPort(),
         .platform_https = MainParams().GetDefaultPlatformHTTPPort(),
     };
-    BOOST_CHECK(!node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS, /*optional=*/false));
+    BOOST_CHECK(!node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS,
+                                                     /*ipv4_optional=*/false, /*optional=*/false));
 
     net_info.platform_p2p = static_cast<uint16_t>(MainParams().GetDefaultPlatformP2PPort() + 1);
     auto validation_error{
-        node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS, /*optional=*/false)};
+        node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS,
+                                            /*ipv4_optional=*/false, /*optional=*/false)};
     BOOST_REQUIRE(validation_error);
     BOOST_CHECK_EQUAL(validation_error->reject_reason, "bad-protx-platform-p2p-port");
 
     net_info.platform_p2p = MainParams().GetDefaultPlatformP2PPort();
     net_info.platform_https = static_cast<uint16_t>(MainParams().GetDefaultPlatformHTTPPort() + 1);
     validation_error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS,
-                                                           /*optional=*/false);
+                                                           /*ipv4_optional=*/false, /*optional=*/false);
     BOOST_REQUIRE(validation_error);
     BOOST_CHECK_EQUAL(validation_error->reject_reason, "bad-protx-platform-http-port");
 
     net_info.platform_p2p = MainParams().GetDefaultPort();
     net_info.platform_https = MainParams().GetDefaultPlatformHTTPPort();
     validation_error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS,
-                                                           /*optional=*/false);
+                                                           /*ipv4_optional=*/false, /*optional=*/false);
     BOOST_REQUIRE(validation_error);
     BOOST_CHECK_EQUAL(validation_error->reject_reason, "bad-protx-platform-p2p-port");
 
@@ -192,9 +209,228 @@ BOOST_AUTO_TEST_CASE(provider_network_fields_main)
         .platform_https = std::vector<std::string>{"server.example.com:443"},
     };
     validation_error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr,
-                                                           /*optional=*/false);
+                                                           /*ipv4_optional=*/false, /*optional=*/false);
     BOOST_REQUIRE(validation_error);
     BOOST_CHECK(validation_error->message.original.find("unroutable address") != std::string::npos);
+
+    // On mainnet the first entry of every purpose must use that purpose's port (9999, 26656, 443) and, as
+    // masternodes may not operate without IPv4 there yet, be IPv4, with the first Platform entries on the first
+    // Core P2P address. Additional entries may use other addresses, ports and network types. Shared masternodes
+    // use the same network fields.
+    const std::string a{"1.1.1.1"}, b{"1.1.1.2"}, ipv6{"[2606:4700:4700::1111]"},
+        onion{"pg6mmjiyjmcrsslvykfwnntlaru7p5svn6y2ymmju6nubxndf4pscryd.onion"},
+        i2p{"udhdrtrcetjm5sxzskjyr5ztpeszydbh4dpl3pl4utgqqw2v4jna.b32.i2p:0"}, domain{"platform.example.com"};
+    const auto make = [](std::vector<std::string> core, interfaces::ProviderPlatformEndpoints p2p = {},
+                         interfaces::ProviderPlatformEndpoints https = {}) {
+        return interfaces::ProviderNetInfo{.core_p2p = std::move(core), .platform_p2p = std::move(p2p),
+                                           .platform_https = std::move(https)};
+    };
+    using Strs = std::vector<std::string>;
+    struct Case {
+        MnType type{MnType::Regular};
+        interfaces::ProviderNetInfo net_info;
+        std::string error_field; // Empty if valid, unless reject_reason is set
+        std::string error_status{};
+        std::string reject_reason{}; // Checked instead of the message if set
+    };
+    const std::vector<Case> primary_vals{
+        // Valid, including additional entries of any type, address and port
+        {MnType::Regular, make({a + ":9999"}), ""},
+        {MnType::Regular, make({a + ":9999", b + ":9998", ipv6 + ":9999", onion + ":9999"}), ""},
+        {MnType::Regular, make({a + ":9999", i2p}), ""},
+        {MnType::Evo, make({a + ":9999"}, Strs{a + ":26656"}, Strs{a + ":443"}), ""},
+        {MnType::Evo,
+         make({a + ":9999", ipv6 + ":9999"}, Strs{a + ":26656", b + ":26657", ipv6 + ":26656", onion + ":26656"},
+              Strs{a + ":443", domain + ":443", ipv6 + ":8443"}),
+         ""},
+        {MnType::Evo, make({a + ":9999"}, Strs{a + ":26656"}, Strs{a + ":443", ipv6 + ":443", onion + ":443"}), ""},
+        // Additional addresses may use the standard ports too, e.g. a second IPv4 address on the same ports
+        {MnType::Regular, make({a + ":9999", b + ":9999"}), ""},
+        {MnType::Regular, make({a + ":9999", b + ":26656"}), ""},
+        {MnType::Evo,
+         make({a + ":9999", b + ":9999"}, Strs{a + ":26656", b + ":26656"}, Strs{a + ":443", b + ":443"}), ""},
+        // A bare Platform port is placed on the first Core P2P address
+        {MnType::Evo, make({a + ":9999"}, uint16_t{26656}, uint16_t{443}), ""},
+        {MnType::Evo, make({a + ":9999"}, uint16_t{26657}, uint16_t{443}), "platformP2PAddrs[0]", "invalid port"},
+        // The first entry of each purpose must use that purpose's port
+        {MnType::Regular, make({a + ":9998"}), "coreP2PAddrs[0]", "invalid port"},
+        {MnType::Regular, make({i2p}), "coreP2PAddrs[0]", "invalid port"},
+        {MnType::Evo, make({a + ":9998"}, Strs{a + ":26656"}, Strs{a + ":443"}), "coreP2PAddrs[0]", "invalid port"},
+        {MnType::Evo, make({a + ":9999"}, Strs{a + ":26657"}, Strs{a + ":443"}), "platformP2PAddrs[0]", "invalid port"},
+        {MnType::Evo, make({a + ":9999"}, Strs{a + ":26656"}, Strs{a + ":8443"}), "platformHTTPSAddrs[0]",
+         "invalid port"},
+        {MnType::Evo, make({a + ":9999"}, Strs{a + ":26656"}, Strs{domain + ":8443", a + ":443"}),
+         "platformHTTPSAddrs[0]", "invalid port"},
+        // The first entry of each purpose must be IPv4, Platform's on the first Core P2P address
+        {MnType::Regular, make({ipv6 + ":9999"}), "", "", "bad-protx-netinfo-addr-type"},
+        {MnType::Regular, make({onion + ":9999", a + ":9999"}), "", "", "bad-protx-netinfo-addr-type"},
+        {MnType::Evo, make({a + ":9999"}, Strs{b + ":26656"}, Strs{a + ":443"}), "", "", "bad-protx-netinfo-addr"},
+        {MnType::Evo, make({a + ":9999"}, Strs{a + ":26656"}, Strs{b + ":443"}), "", "", "bad-protx-netinfo-addr"},
+        {MnType::Evo, make({a + ":9999", ipv6 + ":9999"}, Strs{ipv6 + ":26656"}, Strs{a + ":443"}), "", "",
+         "bad-protx-netinfo-addr-type"},
+        {MnType::Evo, make({a + ":9999"}, Strs{a + ":26656"}, Strs{domain + ":443"}), "", "",
+         "bad-protx-netinfo-addr-type"},
+    };
+    for (const auto& [type, case_net_info, error_field, error_status, reject_reason] : primary_vals) {
+        validation_error = node->evo().validateProviderNetInfo(case_net_info, type, ProTxVersion::ExtAddr,
+                                                               /*ipv4_optional=*/false, /*optional=*/false);
+        BOOST_CHECK_MESSAGE(!validation_error == (error_field.empty() && reject_reason.empty()),
+                            strprintf("%s: %s", Join(case_net_info.core_p2p, ","),
+                                      validation_error ? validation_error->message.original : "accepted"));
+        if (validation_error && !reject_reason.empty()) {
+            BOOST_CHECK_MESSAGE(validation_error->reject_reason == reject_reason, validation_error->message.original);
+        } else if (validation_error && !error_field.empty()) {
+            const auto& message{validation_error->message.original};
+            BOOST_CHECK_MESSAGE(message.find(error_field) != std::string::npos &&
+                                    message.find(strprintf("(%s)", error_status)) != std::string::npos,
+                                message);
+        }
+    }
+
+    // Validation needs no chain: the caller supplies whether masternodes may operate without IPv4, which lifts
+    // the IPv4 and same-address rules but not the port pins
+    for (const auto& [type, case_net_info, _field, _status, reject_reason] : primary_vals) {
+        if (reject_reason.empty()) continue;
+        BOOST_CHECK(!node->evo().validateProviderNetInfo(case_net_info, type, ProTxVersion::ExtAddr,
+                                                         /*ipv4_optional=*/true, /*optional=*/false));
+    }
+    validation_error = node->evo().validateProviderNetInfo(make({ipv6 + ":9998"}), MnType::Regular,
+                                                           ProTxVersion::ExtAddr, /*ipv4_optional=*/true,
+                                                           /*optional=*/false);
+    BOOST_REQUIRE(validation_error);
+    BOOST_CHECK(validation_error->message.original.find("(invalid port)") != std::string::npos);
+}
+
+struct TestNetSetup : public BasicTestingSetup {
+    TestNetSetup() : BasicTestingSetup{CBaseChainParams::TESTNET} {}
+};
+
+BOOST_FIXTURE_TEST_CASE(extnetinfo_ports_mainnet_only, TestNetSetup)
+{
+    struct Case {
+        MnType type{MnType::Regular};
+        std::vector<std::pair<NetInfoPurpose, std::string>> entries;
+        bool valid_on_mainnet{false};
+    };
+    const std::string ipv6{"[2606:4700:4700::1111]"};
+    const std::vector<Case> vals{
+        {MnType::Regular, {{NetInfoPurpose::CORE_P2P, "1.1.1.1:19999"}}},
+        {MnType::Evo,
+         {{NetInfoPurpose::CORE_P2P, "1.1.1.1:9999"}, {NetInfoPurpose::PLATFORM_P2P, "1.1.1.1:22000"},
+          {NetInfoPurpose::PLATFORM_HTTPS, "1.1.1.1:443"}}},
+        {MnType::Evo,
+         {{NetInfoPurpose::CORE_P2P, "1.1.1.1:9999"}, {NetInfoPurpose::PLATFORM_P2P, "1.1.1.1:26656"},
+          {NetInfoPurpose::PLATFORM_HTTPS, "1.1.1.1:8443"}}},
+        // Satisfies the mainnet port rules, with additional entries on any port, including the standard ones
+        {MnType::Evo,
+         {{NetInfoPurpose::CORE_P2P, "1.1.1.1:9999"}, {NetInfoPurpose::CORE_P2P, ipv6 + ":19999"},
+          {NetInfoPurpose::CORE_P2P, "1.1.1.2:9999"}, {NetInfoPurpose::PLATFORM_P2P, "1.1.1.1:26656"},
+          {NetInfoPurpose::PLATFORM_P2P, "1.1.1.2:22000"}, {NetInfoPurpose::PLATFORM_P2P, "1.1.1.3:26656"},
+          {NetInfoPurpose::PLATFORM_HTTPS, "1.1.1.1:443"}, {NetInfoPurpose::PLATFORM_HTTPS, "1.1.1.2:443"},
+          {NetInfoPurpose::PLATFORM_HTTPS, "platform.example.com:443"}},
+         /*valid_on_mainnet=*/true},
+    };
+    const auto check_fields = [](const std::shared_ptr<ExtNetInfo>& net_info, MnType type, TxValidationState& state) {
+        return CheckProviderNetworkFields(net_info, type, ProTxVersion::ExtAddr, /*platform_node_id=*/nullptr,
+                                          /*platform_p2p_port=*/0, /*platform_http_port=*/0, /*allow_empty=*/false,
+                                          /*ipv4_optional=*/false, state);
+    };
+
+    // Outside mainnet, these port rules don't apply
+    std::vector<CDataStream> serialized;
+    for (const auto& [type, entries, _] : vals) {
+        ExtNetInfo net_info;
+        for (const auto& [purpose, entry] : entries) {
+            BOOST_CHECK_EQUAL(net_info.AddEntry(purpose, entry), NetInfoStatus::Success);
+        }
+        BOOST_CHECK_EQUAL(net_info.Validate(), NetInfoStatus::Success);
+        TxValidationState state;
+        BOOST_CHECK(check_fields(std::make_shared<ExtNetInfo>(net_info), type, state));
+        serialized.emplace_back(SER_DISK, CLIENT_VERSION) << net_info;
+    }
+
+    // A serialized ProTx carries its entries as-is, so consensus on mainnet must apply the rules to the
+    // same objects even though they never passed through AddEntry() there
+    SelectParams(CBaseChainParams::MAIN);
+    for (size_t idx{0}; idx < vals.size(); ++idx) {
+        const auto& [type, _, valid_on_mainnet] = vals[idx];
+        const auto net_info{std::make_shared<ExtNetInfo>(deserialize, serialized[idx])};
+        BOOST_CHECK_EQUAL(net_info->Validate(), valid_on_mainnet ? NetInfoStatus::Success : NetInfoStatus::BadPort);
+        TxValidationState state;
+        BOOST_CHECK_EQUAL(check_fields(net_info, type, state), valid_on_mainnet);
+        BOOST_CHECK_EQUAL(state.GetRejectReason(), valid_on_mainnet ? "" : "bad-protx-netinfo-port");
+    }
+    SelectParams(CBaseChainParams::TESTNET);
+}
+
+BOOST_FIXTURE_TEST_CASE(ipv4_primaries_follow_activation, TestNetSetup)
+{
+    // Masternodes may operate without IPv4 on testnet (and devnets), which already has such registrations, but
+    // not yet on mainnet
+    BOOST_CHECK(DeploymentActiveAfter(nullptr, Params().GetConsensus(), Consensus::DEPLOYMENT_IPV4_OPTIONAL));
+    BOOST_CHECK(!DeploymentEnabled(MainParams().GetConsensus(), Consensus::DEPLOYMENT_IPV4_OPTIONAL));
+
+    struct Case {
+        MnType type{MnType::Regular};
+        std::vector<std::pair<NetInfoPurpose, std::string>> entries;
+        std::string reject_reason{}; // Before activation, empty if valid
+    };
+    const std::string ipv6{"[2606:4700:4700::1111]"};
+    const std::string onion{"pg6mmjiyjmcrsslvykfwnntlaru7p5svn6y2ymmju6nubxndf4pscryd.onion"};
+    const std::vector<Case> vals{
+        {MnType::Regular, {{NetInfoPurpose::CORE_P2P, ipv6 + ":9999"}, {NetInfoPurpose::CORE_P2P, "1.1.1.1:9999"}},
+         "bad-protx-netinfo-addr-type"},
+        {MnType::Regular, {{NetInfoPurpose::CORE_P2P, onion + ":9999"}}, "bad-protx-netinfo-addr-type"},
+        {MnType::Evo,
+         {{NetInfoPurpose::CORE_P2P, "1.1.1.1:9999"}, {NetInfoPurpose::PLATFORM_P2P, "1.1.1.2:26656"},
+          {NetInfoPurpose::PLATFORM_HTTPS, "1.1.1.1:443"}},
+         "bad-protx-netinfo-addr"},
+        {MnType::Evo,
+         {{NetInfoPurpose::CORE_P2P, "1.1.1.1:9999"}, {NetInfoPurpose::PLATFORM_P2P, "1.1.1.1:26656"},
+          {NetInfoPurpose::PLATFORM_HTTPS, "1.1.1.2:443"}},
+         "bad-protx-netinfo-addr"},
+        {MnType::Evo,
+         {{NetInfoPurpose::CORE_P2P, "1.1.1.1:9999"}, {NetInfoPurpose::CORE_P2P, ipv6 + ":9999"},
+          {NetInfoPurpose::PLATFORM_P2P, ipv6 + ":26656"}, {NetInfoPurpose::PLATFORM_HTTPS, "1.1.1.1:443"}},
+         "bad-protx-netinfo-addr-type"},
+        {MnType::Evo,
+         {{NetInfoPurpose::CORE_P2P, "1.1.1.1:9999"}, {NetInfoPurpose::PLATFORM_P2P, "1.1.1.1:26656"},
+          {NetInfoPurpose::PLATFORM_HTTPS, "platform.example.com:443"}},
+         "bad-protx-netinfo-addr-type"},
+        {MnType::Evo,
+         {{NetInfoPurpose::CORE_P2P, "1.1.1.1:9999"}, {NetInfoPurpose::CORE_P2P, ipv6 + ":9999"},
+          {NetInfoPurpose::PLATFORM_P2P, "1.1.1.1:26656"}, {NetInfoPurpose::PLATFORM_P2P, onion + ":26656"},
+          {NetInfoPurpose::PLATFORM_HTTPS, "1.1.1.1:443"},
+          {NetInfoPurpose::PLATFORM_HTTPS, "platform.example.com:443"}}},
+    };
+    const auto check = [](const std::shared_ptr<ExtNetInfo>& net_info, const Case& val) {
+        BOOST_CHECK_EQUAL(net_info->Validate(), NetInfoStatus::Success);
+        TxValidationState state;
+        BOOST_CHECK(CheckProviderNetworkFields(net_info, val.type, ProTxVersion::ExtAddr, nullptr, 0, 0,
+                                               /*allow_empty=*/false, /*ipv4_optional=*/true, state));
+        BOOST_CHECK_EQUAL(CheckProviderNetworkFields(net_info, val.type, ProTxVersion::ExtAddr, nullptr, 0, 0,
+                                                     /*allow_empty=*/false, /*ipv4_optional=*/false, state),
+                          val.reject_reason.empty());
+        BOOST_CHECK_EQUAL(state.GetRejectReason(), val.reject_reason);
+    };
+
+    std::vector<CDataStream> serialized;
+    for (const auto& val : vals) {
+        auto net_info{std::make_shared<ExtNetInfo>()};
+        for (const auto& [purpose, entry] : val.entries) {
+            BOOST_CHECK_EQUAL(net_info->AddEntry(purpose, entry), NetInfoStatus::Success);
+        }
+        check(net_info, val);
+        serialized.emplace_back(SER_DISK, CLIENT_VERSION) << *net_info;
+    }
+
+    // The rule depends on the activation, not the network. Validate(), which also checks stored masternode states
+    // without a height, doesn't apply it.
+    SelectParams(CBaseChainParams::MAIN);
+    for (size_t idx{0}; idx < vals.size(); ++idx) {
+        check(std::make_shared<ExtNetInfo>(deserialize, serialized[idx]), vals[idx]);
+    }
+    SelectParams(CBaseChainParams::TESTNET);
 }
 
 static const std::vector<TestEntry> addr_vals_reg{
diff --git a/src/test/evo_snapshot_tests.cpp b/src/test/evo_snapshot_tests.cpp
index f5ab9a732e98..b37505044867 100644
--- a/src/test/evo_snapshot_tests.cpp
+++ b/src/test/evo_snapshot_tests.cpp
@@ -80,8 +80,11 @@ CDeterministicMNCPtr MN(uint64_t internal_id, uint8_t hash_suffix, MnType type,
                         NetInfoStatus::Success);
     if (type == MnType::Evo) {
         state->platformNodeID = H160(address_tag + 40);
+        // Platform on another address, with a domain first for HTTPS, as DEPLOYMENT_IPV4_OPTIONAL allows, on the
+        // standard ports, which mainnet pins. Such states load on every network: the IPv4 rule applies to ProTxs,
+        // at the height they are mined at.
         BOOST_REQUIRE_EQUAL(state->netInfo->AddEntry(NetInfoPurpose::PLATFORM_P2P,
-                                                    strprintf("2.2.2.%d:26657", address_tag)),
+                                                    strprintf("2.2.2.%d:26656", address_tag)),
                             NetInfoStatus::Success);
         BOOST_REQUIRE_EQUAL(state->netInfo->AddEntry(NetInfoPurpose::PLATFORM_HTTPS,
                                                     strprintf("evo%d.example.org:443", address_tag)),
@@ -317,7 +320,7 @@ BOOST_AUTO_TEST_CASE(rotation_bitset_larger_than_quorum_roundtrips)
 BOOST_FIXTURE_TEST_CASE(populated_v3_golden_value, BasicTestingSetup)
 {
     BOOST_CHECK_EQUAL(GetEvoSnapshotHash(SyntheticSnapshot()).ToString(),
-                      "5b5d496a66d93775a6a6d1badf2ea2d5bbb25b58031fe0dd2c3c670674c6908d");
+                      "8a2883207069e92589ffcce1f9867736881ecdf04ccfc89b492570740e7d3f31");
 }
 
 BOOST_FIXTURE_TEST_CASE(canonical_mn_reader_rejects_order_and_counter, BasicTestingSetup)
diff --git a/src/test/index_migration_tests.cpp b/src/test/index_migration_tests.cpp
new file mode 100644
index 000000000000..3eae5e0ee4bb
--- /dev/null
+++ b/src/test/index_migration_tests.cpp
@@ -0,0 +1,69 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <coins.h>
+#include <index/timestampindex.h>
+#include <interfaces/chain.h>
+#include <node/blockstorage.h>
+#include <test/util/setup_common.h>
+#include <txdb.h>
+#include <util/system.h>
+#include <validation.h>
+
+#include <boost/test/unit_test.hpp>
+
+namespace {
+struct IndexMigrationSetup : public TestChainSetup {
+    IndexMigrationSetup() :
+        TestChainSetup{100, CBaseChainParams::REGTEST, {"-timestampindex=1"}}
+    {
+    }
+
+    //! Give MigrateOldIndexData() the on-disk chainstate best block it reads on a real node.
+    void WriteChainstateBestBlock()
+    {
+        const uint256 tip{WITH_LOCK(cs_main, return m_node.chainman->ActiveChain().Tip()->GetBlockHash())};
+        CCoinsViewDB coins_db{gArgs.GetDataDirNet() / "chainstate", /*nCacheSize=*/1 << 20, /*fMemory=*/false,
+                              /*fWipe=*/false};
+        CCoinsMapMemoryResource resource;
+        CCoinsMap no_coins{0, CCoinsMap::hasher{}, CCoinsMap::key_equal{}, &resource};
+        BOOST_REQUIRE(coins_db.BatchWrite(no_coins, tip));
+    }
+
+    //! Height the timestamp index resumes from, read before its sync thread can advance it.
+    int LoadedTimestampIndexHeight()
+    {
+        node::g_indexes_ready_to_sync = false;
+        TimestampIndex index{interfaces::MakeChain(m_node), /*n_cache_size=*/1 << 20};
+        BOOST_REQUIRE(index.Start());
+        const int height{index.GetSummary().best_block_height};
+        index.Interrupt();
+        index.Stop();
+        node::g_indexes_ready_to_sync = true;
+        return height;
+    }
+};
+} // namespace
+
+BOOST_AUTO_TEST_SUITE(index_migration_tests)
+
+// A datadir upgraded from v23 keeps its legacy "timestampindex" flag. If the index's own
+// database is then missing (deleted to rebuild it), there is nothing left to migrate, and
+// the empty database must not be stamped with the chain tip as if it were synced.
+BOOST_FIXTURE_TEST_CASE(empty_index_is_not_adopted_as_migrated, IndexMigrationSetup)
+{
+    WriteChainstateBestBlock();
+    CBlockTreeDB& block_tree_db{*WITH_LOCK(cs_main, return m_node.chainman->m_blockman.m_block_tree_db.get())};
+    BOOST_REQUIRE(block_tree_db.WriteFlag("timestampindex", true));
+
+    BOOST_REQUIRE(WITH_LOCK(cs_main, return block_tree_db.MigrateOldIndexData()));
+
+    BOOST_CHECK_EQUAL(LoadedTimestampIndexHeight(), 0);
+    // The legacy entries are gone, so older versions must not trust their synchronous index either.
+    bool legacy_current{true};
+    BOOST_REQUIRE(block_tree_db.ReadFlag("timestampindex", legacy_current));
+    BOOST_CHECK(!legacy_current);
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/interfaces_tests.cpp b/src/test/interfaces_tests.cpp
index 1ccbff17eb8c..d4533e4b245a 100644
--- a/src/test/interfaces_tests.cpp
+++ b/src/test/interfaces_tests.cpp
@@ -25,6 +25,9 @@
 
 #include <algorithm>
 #include <array>
+#include <chrono>
+#include <future>
+#include <thread>
 
 #include <boost/test/unit_test.hpp>
 
@@ -86,6 +89,41 @@ BOOST_AUTO_TEST_CASE(providerTxCapabilities)
                                                              *Assert(m_node.chainman)))};
     BOOST_CHECK_EQUAL(capabilities.version, expected_version);
     BOOST_CHECK_EQUAL(capabilities.extended_addresses, expected_version >= ProTxVersion::ExtAddr);
+    BOOST_CHECK(!capabilities.ipv4_optional); // Not active on regtest by default
+}
+
+struct IPv4OptionalChainSetup : public TestChain100Setup {
+    IPv4OptionalChainSetup()
+        : TestChain100Setup{CBaseChainParams::REGTEST, {"-testactivationheight=ipv4_optional@1"}} {}
+};
+
+BOOST_FIXTURE_TEST_CASE(providerTxCapabilitiesIPv4Optional, IPv4OptionalChainSetup)
+{
+    BOOST_CHECK(interfaces::MakeNode(m_node)->evo().getProviderTxCapabilities().ipv4_optional);
+}
+
+BOOST_AUTO_TEST_CASE(providerNetInfoValidationDoesNotWaitForChain)
+{
+    // Dialogs validate endpoints on every keystroke, so that must not wait for cs_main
+    auto node{interfaces::MakeNode(m_node)};
+    const interfaces::ProviderNetInfo net_info{.core_p2p = {"1.1.1.1:9998"},
+                                               .platform_p2p = std::vector<std::string>{"1.1.1.1:22200"},
+                                               .platform_https = std::vector<std::string>{"1.1.1.1:443"}};
+    std::promise<void> locked;
+    std::promise<void> release;
+    bool lock_timed_out{false};
+    std::thread holder{[&] {
+        LOCK(::cs_main);
+        locked.set_value();
+        lock_timed_out = release.get_future().wait_for(std::chrono::seconds{10}) == std::future_status::timeout;
+    }};
+    locked.get_future().wait();
+    const auto error{node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr,
+                                                         /*ipv4_optional=*/false, /*optional=*/false)};
+    release.set_value();
+    holder.join();
+    BOOST_CHECK(!lock_timed_out);
+    BOOST_CHECK(!error);
 }
 
 BOOST_AUTO_TEST_CASE(providerNetInfoValidation)
@@ -97,33 +135,47 @@ BOOST_AUTO_TEST_CASE(providerNetInfoValidation)
         .platform_https = std::vector<std::string>{"server.example.com:443"},
     };
 
-    BOOST_CHECK(!node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/false));
+    // Unless the caller's capabilities say masternodes may operate without IPv4, Platform must use the Core address
+    auto error{node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr,
+                                                   /*ipv4_optional=*/false, /*optional=*/false)};
+    BOOST_REQUIRE(error);
+    BOOST_CHECK_EQUAL(error->reject_reason, "bad-protx-netinfo-addr");
+
+    net_info.platform_p2p = std::vector<std::string>{"1.1.1.1:22200"};
+    net_info.platform_https = std::vector<std::string>{"1.1.1.1:443", "server.example.com:443"};
+    BOOST_CHECK(!node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr,
+                                                     /*ipv4_optional=*/false, /*optional=*/false));
 
     net_info.platform_p2p = std::vector<std::string>{"server.example.com:22200"};
-    auto error{node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/false)};
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr,
+                                                /*ipv4_optional=*/false, /*optional=*/false);
     BOOST_REQUIRE(error);
     BOOST_CHECK_EQUAL(error->code, interfaces::ProviderTxErrorCode::INVALID_PARAMETER);
     BOOST_CHECK_EQUAL(error->message.original,
                       "Error setting platformP2PAddrs[0] to 'server.example.com:22200' (invalid input)");
 
     net_info.platform_p2p = std::vector<std::string>{"1.1.1.1:9998"};
-    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/false);
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr,
+                                                /*ipv4_optional=*/false, /*optional=*/false);
     BOOST_REQUIRE(error);
     BOOST_CHECK_EQUAL(error->message.original, "Error setting platformP2PAddrs[0] to '1.1.1.1:9998' (duplicate)");
 
     net_info.platform_p2p = std::vector<std::string>{"1.1.1.2:22200", "1.1.1.3:22200", "1.1.1.4:22200", "1.1.1.5:22200",
                                                      "1.1.1.6:22200"};
-    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/false);
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr,
+                                                /*ipv4_optional=*/false, /*optional=*/false);
     BOOST_REQUIRE(error);
     BOOST_CHECK_EQUAL(error->message.original,
                       "Error setting platformP2PAddrs[4] to '1.1.1.6:22200' (too many entries)");
 
     net_info.platform_p2p = uint16_t{22200};
     net_info.platform_https = uint16_t{22201};
-    BOOST_CHECK(!node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS, /*optional=*/false));
+    BOOST_CHECK(!node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS,
+                                                     /*ipv4_optional=*/false, /*optional=*/false));
 
     net_info.platform_p2p = std::vector<std::string>{"1.1.1.2:22200"};
-    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS, /*optional=*/false);
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS,
+                                                /*ipv4_optional=*/false, /*optional=*/false);
     BOOST_REQUIRE(error);
     BOOST_CHECK(error->message.original.find("only accepts a bare port number") != std::string::npos);
 
@@ -132,7 +184,8 @@ BOOST_AUTO_TEST_CASE(providerNetInfoValidation)
         .platform_p2p = std::vector<std::string>{"1.1.1.2:22200"},
         .platform_https = std::vector<std::string>{"server.example.com:443"},
     };
-    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/true);
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr,
+                                                /*ipv4_optional=*/false, /*optional=*/true);
     BOOST_REQUIRE(error);
     BOOST_CHECK_EQUAL(error->reject_reason, "bad-protx-netinfo-empty");
 
@@ -141,14 +194,17 @@ BOOST_AUTO_TEST_CASE(providerNetInfoValidation)
         .platform_p2p = std::monostate{},
         .platform_https = std::monostate{},
     };
-    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/true);
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr,
+                                                /*ipv4_optional=*/false, /*optional=*/true);
     BOOST_REQUIRE(error);
     BOOST_CHECK(error->message.original.find("platformP2PAddrs, cannot be empty if other fields populated") !=
                 std::string::npos);
-    BOOST_CHECK(!node->evo().validateProviderNetInfo(net_info, MnType::Regular, ProTxVersion::ExtAddr, /*optional=*/true));
+    BOOST_CHECK(!node->evo().validateProviderNetInfo(net_info, MnType::Regular, ProTxVersion::ExtAddr,
+                                                     /*ipv4_optional=*/false, /*optional=*/true));
 
     net_info.platform_p2p = std::vector<std::string>{"1.1.1.2:22200"};
-    error = node->evo().validateProviderNetInfo(net_info, MnType::Regular, ProTxVersion::ExtAddr, /*optional=*/true);
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Regular, ProTxVersion::ExtAddr,
+                                                /*ipv4_optional=*/false, /*optional=*/true);
     BOOST_REQUIRE(error);
     BOOST_CHECK_EQUAL(error->message.original, "Platform endpoints are only valid for an EvoNode");
 
@@ -157,7 +213,8 @@ BOOST_AUTO_TEST_CASE(providerNetInfoValidation)
         .platform_p2p = std::vector<std::string>{"1.1.1.2:22200"},
         .platform_https = std::monostate{},
     };
-    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/true);
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr,
+                                                /*ipv4_optional=*/false, /*optional=*/true);
     BOOST_REQUIRE(error);
     BOOST_CHECK(error->message.original.find("platformHTTPSAddrs, cannot be empty if other fields populated") !=
                 std::string::npos);
@@ -167,13 +224,15 @@ BOOST_AUTO_TEST_CASE(providerNetInfoValidation)
         .platform_p2p = uint16_t{22200},
         .platform_https = uint16_t{22200},
     };
-    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS, /*optional=*/false);
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS,
+                                                /*ipv4_optional=*/false, /*optional=*/false);
     BOOST_REQUIRE(error);
     BOOST_CHECK_EQUAL(error->reject_reason, "bad-protx-platform-dup-ports");
 
     net_info.platform_p2p = uint16_t{MainParams().GetDefaultPort()};
     net_info.platform_https = uint16_t{22201};
-    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS, /*optional=*/false);
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS,
+                                                /*ipv4_optional=*/false, /*optional=*/false);
     BOOST_REQUIRE(error);
     BOOST_CHECK_EQUAL(error->reject_reason, "bad-protx-platform-p2p-port");
 }
diff --git a/src/test/util/setup_common.cpp b/src/test/util/setup_common.cpp
index fcf071dcd598..50170ce9872a 100644
--- a/src/test/util/setup_common.cpp
+++ b/src/test/util/setup_common.cpp
@@ -223,6 +223,7 @@ BasicTestingSetup::BasicTestingSetup(const std::string& chainName, const std::ve
     }
 
     bls::bls_legacy_scheme.store(true);
+    node::g_indexes_ready_to_sync = true;
 }
 
 BasicTestingSetup::~BasicTestingSetup()
diff --git a/src/txdb.cpp b/src/txdb.cpp
index 4ec4ce9f3702..8916f14f79f1 100644
--- a/src/txdb.cpp
+++ b/src/txdb.cpp
@@ -479,14 +479,17 @@ static bool FinalizeMigration(CDBWrapper& target_db, const uint256& best_block_h
     return true;
 }
 
-// Returns true if the target index database has no best-block locator yet —
-// i.e. the new async index has never been finalized on this datadir. Used to
-// guard FinalizeMigration so we don't regress an already-advanced locator
-// (e.g. left by ThreadSync after a previous successful migration).
+// Returns true if the target index database holds migrated entries but no best-block
+// locator yet, i.e. a migration copied data that was never finalized. Used to guard
+// FinalizeMigration so we don't regress an already-advanced locator (e.g. left by
+// ThreadSync after a previous successful migration), and so we never stamp the chain
+// tip onto an empty target (e.g. index directories deleted after an earlier migration
+// already moved the legacy entries), which would report an empty index as synced.
 static bool TargetNeedsLocator(CDBWrapper& target_db)
 {
     CBlockLocator existing;
-    return !target_db.Read(DB_BEST_BLOCK, existing) || existing.IsNull();
+    if (target_db.Read(DB_BEST_BLOCK, existing) && !existing.IsNull()) return false;
+    return !target_db.IsEmpty();
 }
 
 bool CBlockTreeDB::MigrateOldIndexData()
@@ -523,7 +526,11 @@ bool CBlockTreeDB::MigrateOldIndexData()
     // the legacy entries don't cover the suffix of the chain that ran with the index
     // disabled, and copying them while stamping the chainstate tip as the locator would
     // mark an incomplete index as fully synced. In that case we discard the source entries
-    // instead and let the new async index resync from genesis.
+    // instead and let the new async index resync from genesis. Once an enabled index has been
+    // processed its legacy entries are gone, so its flag is cleared: a later start must never
+    // adopt whatever the new database then holds (for example a partial rebuild after the
+    // index directory was deleted) as migrated data, and older versions see that their
+    // synchronous index needs a reindex.
     bool legacy_flag = false;
     const bool addressindex_was_current   = ReadFlag("addressindex",   legacy_flag) && legacy_flag;
     const bool spentindex_was_current     = ReadFlag("spentindex",     legacy_flag) && legacy_flag;
@@ -579,12 +586,14 @@ bool CBlockTreeDB::MigrateOldIndexData()
             return false;
         }
         // Finalize even when count==0 to recover from a previous run that crashed
-        // after writing target data but before writing the locator.
+        // after writing target data but before writing the locator. An empty target is
+        // left without a locator, so the index rebuilds from genesis.
         if (timestampindex_was_current && TargetNeedsLocator(timestamp_db)) {
             if (!FinalizeMigration(timestamp_db, best_block_hash, "timestamp index")) {
                 return false;
             }
         }
+        WriteFlag("timestampindex", false);
     }
 
     // Migrate spent index (only if enabled)
@@ -603,6 +612,7 @@ bool CBlockTreeDB::MigrateOldIndexData()
                 return false;
             }
         }
+        WriteFlag("spentindex", false);
     }
 
     // Migrate address index (includes both address and unspent indexes) (only if enabled)
@@ -631,6 +641,7 @@ bool CBlockTreeDB::MigrateOldIndexData()
                 return false;
             }
         }
+        WriteFlag("addressindex", false);
     }
 
     if (total_count > 0) {
diff --git a/src/util/system.cpp b/src/util/system.cpp
index d3b889b9d69b..c7ac9e8b7803 100644
--- a/src/util/system.cpp
+++ b/src/util/system.cpp
@@ -999,13 +999,6 @@ bool ArgsManager::ReadConfigFiles(std::string& error, bool ignore_invalid_keys)
                 tfm::format(std::cerr, "warning: -includeconf cannot be used from included files; ignoring -includeconf=%s\n", conf_file_name);
             }
         }
-    } else {
-        // Create an empty dash.conf if it does not exist
-        std::ofstream configFile{conf_path, std::ios_base::app};
-        if (!configFile.good())
-            return false;
-        configFile.close();
-        return true; // Nothing to read, so just return
     }
 
     // If datadir is changed in .conf file:
diff --git a/src/validation.cpp b/src/validation.cpp
index da6025861e4c..71a55d70615b 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -3102,6 +3102,7 @@ bool Chainstate::FlushStateToDisk(
                 // Flush the chainstate (which may refer to block index entries).
                 if (!CoinsTip().Flush())
                     return AbortNode(state, "Failed to write to coin database");
+                m_last_flushed_block = m_blockman.LookupBlockIndex(CoinsTip().GetBestBlock());
             }
             {
                 LOG_TIME_SECONDS("write evodb cache to disk");
@@ -3120,9 +3121,8 @@ bool Chainstate::FlushStateToDisk(
         }
     }
     if (full_flush_completed && this == &m_chainman.ActiveChainstate()) {
-        // Update best block in wallet (so we can detect restored wallets).
         // TODO(assumeutxo): upstream tags this notification with ChainstateRole instead of suppressing; adopt when backporting index/wallet assumeutxo support.
-        GetMainSignals().ChainStateFlushed(m_chain.GetLocator());
+        GetMainSignals().ChainStateFlushed(GetLocator(m_last_flushed_block));
     }
     } catch (const std::runtime_error& e) {
         return AbortNode(state, std::string("System error while flushing: ") + e.what());
@@ -5017,6 +5017,7 @@ bool Chainstate::LoadChainTip()
         return false;
     }
     m_chain.SetTip(*pindex);
+    m_last_flushed_block = pindex;
     PruneBlockIndexCandidates();
 
     tip = m_chain.Tip();
@@ -6818,6 +6819,7 @@ SpecialTxRules GetSpecialTxRules(const CBlockIndex* pindexPrev, const Chainstate
     return SpecialTxRules{
         .v24 = DeploymentActiveAfter(pindexPrev, chainman, Consensus::DEPLOYMENT_V24),
         .evo_shares = DeploymentActiveAfter(pindexPrev, chainman, Consensus::DEPLOYMENT_EVO_SHARES),
+        .ipv4_optional = DeploymentActiveAfter(pindexPrev, chainman, Consensus::DEPLOYMENT_IPV4_OPTIONAL),
     };
 }
 
diff --git a/src/validation.h b/src/validation.h
index de5c2fc754e8..24111786b252 100644
--- a/src/validation.h
+++ b/src/validation.h
@@ -766,6 +766,9 @@ class Chainstate
 
     std::string ToString() EXCLUSIVE_LOCKS_REQUIRED(::cs_main);
 
+    //! Get the last block that was flushed to disk.
+    const CBlockIndex* GetLastFlushedBlock() const EXCLUSIVE_LOCKS_REQUIRED(::cs_main) { return m_last_flushed_block; }
+
     //! Indirection necessary to make lock annotations work with an optional mempool.
     RecursiveMutex* MempoolMutex() const LOCK_RETURNED(m_mempool->cs)
     {
@@ -810,6 +813,7 @@ class Chainstate
 
     SteadyClock::time_point m_last_write{};
     SteadyClock::time_point m_last_flush{};
+    const CBlockIndex* m_last_flushed_block GUARDED_BY(::cs_main){nullptr};
 
     /**
      * In case of an invalid snapshot, rename the coins leveldb directory so
diff --git a/src/wallet/bdb.cpp b/src/wallet/bdb.cpp
index 9042ad70c3b8..e0ac9b230d90 100644
--- a/src/wallet/bdb.cpp
+++ b/src/wallet/bdb.cpp
@@ -13,6 +13,7 @@
 #include <util/strencodings.h>
 #include <util/translation.h>
 
+#include <set>
 #include <stdint.h>
 
 #include <sys/stat.h>
@@ -300,6 +301,53 @@ bool BerkeleyDatabase::Verify(bilingual_str& errorStr)
     return true;
 }
 
+std::vector<fs::path> BerkeleyDatabase::Files()
+{
+    std::vector<fs::path> files;
+    // If the wallet is the *only* file, clean up the entire BDB environment
+    constexpr auto build_files_list = [](std::vector<fs::path>& files, const std::shared_ptr<BerkeleyEnvironment>& env, const fs::path& filename) {
+        if (env->m_databases.size() != 1) return false;
+
+        const auto env_dir = env->Directory();
+        const auto db_subdir = env_dir / "database";
+        if (fs::exists(db_subdir)) {
+            if (!fs::is_directory(db_subdir)) return false;
+            for (const auto& entry : fs::directory_iterator(db_subdir)) {
+                const auto& path = entry.path().filename();
+                if (!fs::PathToString(path).starts_with("log.")) {
+                    return false;
+                }
+                files.emplace_back(entry.path());
+            }
+        }
+        const std::set<fs::path> allowed_paths = {
+            filename,
+            "db.log",
+            ".walletlock",
+            "database"
+        };
+        for (const auto& entry : fs::directory_iterator(env_dir)) {
+            const auto& path = entry.path().filename();
+            if (allowed_paths.contains(path)) {
+                files.emplace_back(entry.path());
+            } else if (fs::is_directory(entry.path())) {
+                // Subdirectories can't possibly be using this db env, and is expected if this is a non-directory wallet
+                // Do not include them in Files, but still allow the env cleanup
+            } else {
+                return false;
+            }
+        }
+        return true;
+    };
+    try {
+        if (build_files_list(files, env, m_filename)) return files;
+    } catch (...) {
+        // Give up building the comprehensive file list if any error occurs
+    }
+    // Otherwise, it's only really safe to delete the one wallet file
+    return {env->Directory() / m_filename};
+}
+
 void BerkeleyEnvironment::CheckpointLSN(const std::string& strFile)
 {
     dbenv->txn_checkpoint(0, 0, 0);
diff --git a/src/wallet/bdb.h b/src/wallet/bdb.h
index 7bc2c55e053a..cdbd4968621a 100644
--- a/src/wallet/bdb.h
+++ b/src/wallet/bdb.h
@@ -134,6 +134,8 @@ class BerkeleyDatabase : public WalletDatabase
     /** Return path to main database filename */
     std::string Filename() override { return fs::PathToString(env->Directory() / m_filename); }
 
+    std::vector<fs::path> Files() override;
+
     std::string Format() override { return "bdb"; }
     /**
      * Pointer to shared database environment.
diff --git a/src/wallet/db.h b/src/wallet/db.h
index dc89ed9497c3..188bf6611c8d 100644
--- a/src/wallet/db.h
+++ b/src/wallet/db.h
@@ -162,6 +162,9 @@ class WalletDatabase
     /** Return path to main database file for logs and error messages. */
     virtual std::string Filename() = 0;
 
+    /** Return paths to all database created files */
+    virtual std::vector<fs::path> Files() = 0;
+
     virtual std::string Format() = 0;
 
     std::atomic<unsigned int> nUpdateCounter;
@@ -216,6 +219,7 @@ class DummyDatabase : public WalletDatabase
     void IncrementUpdateCounter() override { ++nUpdateCounter; }
     void ReloadDbEnv() override {}
     std::string Filename() override { return "dummy"; }
+    std::vector<fs::path> Files() override { return {}; }
     std::string Format() override { return "dummy"; }
     std::unique_ptr<DatabaseBatch> MakeBatch(bool flush_on_close = true) override { return std::make_unique<DummyBatch>(); }
 };
diff --git a/src/wallet/dump.cpp b/src/wallet/dump.cpp
index 2b3ac280f31d..9c18fb10e12e 100644
--- a/src/wallet/dump.cpp
+++ b/src/wallet/dump.cpp
@@ -279,11 +279,17 @@ bool CreateFromDump(const ArgsManager& args, const std::string& name, const fs::
 
         dump_file.close();
     }
+    // On failure, gather the paths to remove
+    std::vector<fs::path> paths_to_remove = wallet->GetDatabase().Files();
+    if (!name.empty()) paths_to_remove.push_back(wallet_path);
+
     wallet.reset(); // The pointer deleter will close the wallet for us.
 
     // Remove the wallet dir if we have a failure
     if (!ret) {
-        fs::remove_all(wallet_path);
+        for (const auto& p : paths_to_remove) {
+            fs::remove(p);
+        }
     }
 
     return ret;
diff --git a/src/wallet/interfaces.cpp b/src/wallet/interfaces.cpp
index 68e6165ae594..64255cee086d 100644
--- a/src/wallet/interfaces.cpp
+++ b/src/wallet/interfaces.cpp
@@ -920,7 +920,7 @@ class WalletLoaderImpl : public WalletLoader
         m_context.node_context = &node_context;
         m_context.coinjoin_loader = &coinjoin_loader;
     }
-    ~WalletLoaderImpl() override { UnloadWallets(m_context); }
+    ~WalletLoaderImpl() override { stop(); }
 
     //! ChainClient methods
     void registerRpcs() override
@@ -931,7 +931,7 @@ class WalletLoaderImpl : public WalletLoader
     bool load() override { return LoadWallets(m_context); }
     void start(CScheduler& scheduler) override { return StartWallets(m_context, scheduler); }
     void flush() override { return FlushWallets(m_context); }
-    void stop() override { return StopWallets(m_context); }
+    void stop() override { return UnloadWallets(m_context); }
     void setMockTime(int64_t time) override { return SetMockTime(time); }
 
     //! WalletLoader methods
diff --git a/src/wallet/load.cpp b/src/wallet/load.cpp
index 864b047e7712..5da46665b533 100644
--- a/src/wallet/load.cpp
+++ b/src/wallet/load.cpp
@@ -169,13 +169,6 @@ void FlushWallets(WalletContext& context)
     }
 }
 
-void StopWallets(WalletContext& context)
-{
-    for (const std::shared_ptr<CWallet>& pwallet : GetWallets(context)) {
-        pwallet->Close();
-    }
-}
-
 void UnloadWallets(WalletContext& context)
 {
     auto wallets = GetWallets(context);
diff --git a/src/wallet/load.h b/src/wallet/load.h
index 88973e428c63..c4d70a394a9b 100644
--- a/src/wallet/load.h
+++ b/src/wallet/load.h
@@ -35,10 +35,6 @@ void StartWallets(WalletContext& context, CScheduler& scheduler);
 //! Flush all wallets in preparation for shutdown.
 void FlushWallets(WalletContext& context);
 
-//! Stop all wallets. Wallets will be flushed first.
-void StopWallets(WalletContext& context);
-
-//! Close all wallets.
 void UnloadWallets(WalletContext& context);
 } // namespace wallet
 
diff --git a/src/wallet/sqlite.cpp b/src/wallet/sqlite.cpp
index c534693af164..84ab061e4138 100644
--- a/src/wallet/sqlite.cpp
+++ b/src/wallet/sqlite.cpp
@@ -109,12 +109,12 @@ Mutex SQLiteDatabase::g_sqlite_mutex;
 int SQLiteDatabase::g_sqlite_count = 0;
 
 SQLiteDatabase::SQLiteDatabase(const fs::path& dir_path, const fs::path& file_path, const DatabaseOptions& options, bool mock)
-    : WalletDatabase(), m_mock(mock), m_dir_path(fs::PathToString(dir_path)), m_file_path(fs::PathToString(file_path)), m_use_unsafe_sync(options.use_unsafe_sync)
+    : WalletDatabase(), m_mock(mock), m_dir_path(dir_path), m_file_path(fs::PathToString(file_path)), m_use_unsafe_sync(options.use_unsafe_sync)
 {
     {
         LOCK(g_sqlite_mutex);
         LogPrintf("Using SQLite Version %s\n", SQLiteDatabaseVersion());
-        LogPrintf("Using wallet %s\n", m_dir_path);
+        LogPrintf("Using wallet %s\n", fs::PathToString(m_dir_path));
 
         if (++g_sqlite_count == 1) {
             // Setup logging
@@ -250,7 +250,7 @@ void SQLiteDatabase::Open()
 
     if (m_db == nullptr) {
         if (!m_mock) {
-            TryCreateDirectories(fs::PathFromString(m_dir_path));
+            TryCreateDirectories(m_dir_path);
         }
         int ret = sqlite3_open_v2(m_file_path.c_str(), &m_db, flags, nullptr);
         if (ret != SQLITE_OK) {
diff --git a/src/wallet/sqlite.h b/src/wallet/sqlite.h
index a5350b1ecec4..b5d142434b59 100644
--- a/src/wallet/sqlite.h
+++ b/src/wallet/sqlite.h
@@ -76,7 +76,7 @@ class SQLiteDatabase : public WalletDatabase
 private:
     const bool m_mock{false};
 
-    const std::string m_dir_path;
+    const fs::path m_dir_path;
 
     const std::string m_file_path;
 
@@ -133,6 +133,14 @@ class SQLiteDatabase : public WalletDatabase
     void IncrementUpdateCounter() override { ++nUpdateCounter; }
 
     std::string Filename() override { return m_file_path; }
+    /** Return paths to all database created files */
+    std::vector<fs::path> Files() override
+    {
+        std::vector<fs::path> files;
+        files.emplace_back(m_dir_path / fs::PathFromString(m_file_path));
+        files.emplace_back(m_dir_path / fs::PathFromString(m_file_path + "-journal"));
+        return files;
+    }
     std::string Format() override { return "sqlite"; }
 
     /** Make a SQLiteBatch connected to this database */
diff --git a/src/wallet/test/wallet_tests.cpp b/src/wallet/test/wallet_tests.cpp
index cd7670ba22cb..4941c70b8f76 100644
--- a/src/wallet/test/wallet_tests.cpp
+++ b/src/wallet/test/wallet_tests.cpp
@@ -109,6 +109,7 @@ class FailDatabase : public WalletDatabase
     void IncrementUpdateCounter() override { ++nUpdateCounter; }
     void ReloadDbEnv() override {}
     std::string Filename() override { return "faildb"; }
+    std::vector<fs::path> Files() override { return {}; }
     std::string Format() override { return "faildb"; }
     std::unique_ptr<DatabaseBatch> MakeBatch(bool = true) override { return std::make_unique<FailBatch>(m_pass); }
 };
@@ -249,8 +250,8 @@ BOOST_FIXTURE_TEST_CASE(scan_for_wallet_transactions, TestChain100Setup)
 
         {
             CBlockLocator locator;
-            BOOST_CHECK(!WalletBatch{wallet.GetDatabase()}.ReadBestBlock(locator));
-            BOOST_CHECK(locator.IsNull());
+            BOOST_CHECK(WalletBatch{wallet.GetDatabase()}.ReadBestBlock(locator));
+            BOOST_CHECK(!locator.IsNull() && locator.vHave.front() == newTip->GetBlockHash());
         }
 
         CWallet::ScanResult result = wallet.ScanForWalletTransactions(/*start_block=*/oldTip->GetBlockHash(), /*start_height=*/oldTip->nHeight, /*max_height=*/{}, reserver, /*fUpdate=*/false, /*save_progress=*/true);
@@ -263,7 +264,7 @@ BOOST_FIXTURE_TEST_CASE(scan_for_wallet_transactions, TestChain100Setup)
         {
             CBlockLocator locator;
             BOOST_CHECK(WalletBatch{wallet.GetDatabase()}.ReadBestBlock(locator));
-            BOOST_CHECK(!locator.IsNull());
+            BOOST_CHECK(!locator.IsNull() && locator.vHave.front() == newTip->GetBlockHash());
         }
     }
 
diff --git a/src/wallet/transaction.cpp b/src/wallet/transaction.cpp
index a46846c1d4a3..4f78fe752054 100644
--- a/src/wallet/transaction.cpp
+++ b/src/wallet/transaction.cpp
@@ -24,4 +24,9 @@ int64_t CWalletTx::GetTxTime() const
     int64_t n = nTimeSmart;
     return n ? n : nTimeReceived;
 }
+
+void CWalletTx::CopyFrom(const CWalletTx& _tx)
+{
+    *this = _tx;
+}
 } // namespace wallet
diff --git a/src/wallet/transaction.h b/src/wallet/transaction.h
index d00e46e0cd8a..76c4ae183151 100644
--- a/src/wallet/transaction.h
+++ b/src/wallet/transaction.h
@@ -340,11 +340,15 @@ class CWalletTx
     bool IsCoinBase() const { return tx->IsCoinBase(); }
     bool IsPlatformTransfer() const { return tx->IsPlatformTransfer(); }
 
+private:
     // Disable copying of CWalletTx objects to prevent bugs where instances get
     // copied in and out of the mapWallet map, and fields are updated in the
     // wrong copy.
-    CWalletTx(CWalletTx const &) = delete;
-    void operator=(CWalletTx const &x) = delete;
+    CWalletTx(const CWalletTx&) = default;
+    CWalletTx& operator=(const CWalletTx&) = default;
+public:
+    // Instead have an explicit copy function
+    void CopyFrom(const CWalletTx&);
 };
 
 struct WalletTxOrderComparator {
diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index c3f765b92df1..4df969a9618d 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -145,6 +145,7 @@ bool RemoveWallet(WalletContext& context, const std::shared_ptr<CWallet>& wallet
 
     interfaces::Chain& chain = wallet->chain();
     std::string name = wallet->GetName();
+    WITH_LOCK(wallet->cs_wallet, wallet->WriteBestBlock());
 
     // Unregister with the validation interface which also drops shared pointers.
     wallet->m_chain_notifications_handler.reset();
@@ -514,6 +515,7 @@ std::shared_ptr<CWallet> RestoreWallet(WalletContext& context, const fs::path& b
     const fs::path wallet_path = fsbridge::AbsPathJoin(GetWalletDir(), fs::u8path(wallet_name));
     auto wallet_file = wallet_path / "wallet.dat";
     std::shared_ptr<CWallet> wallet;
+    bool wallet_file_copied = false;
     bool created_parent_dir = false;
 
     try {
@@ -523,14 +525,34 @@ std::shared_ptr<CWallet> RestoreWallet(WalletContext& context, const fs::path& b
             return nullptr;
         }
 
-        if (fs::exists(wallet_path) || !TryCreateDirectories(wallet_path)) {
-            error = Untranslated(strprintf("Failed to create database path '%s'. Database already exists.", fs::PathToString(wallet_path)));
-            status = DatabaseStatus::FAILED_ALREADY_EXISTS;
-            return nullptr;
+        // Wallet directories are allowed to exist, but must not contain a .dat file.
+        // Any existing wallet database is treated as a hard failure to prevent overwriting.
+        if (fs::exists(wallet_path)) {
+            // If this is a file, it is the db and we don't want to overwrite it.
+            if (!fs::is_directory(wallet_path)) {
+                error = Untranslated(strprintf("Failed to restore wallet. Database file exists '%s'.", fs::PathToString(wallet_path)));
+                status = DatabaseStatus::FAILED_ALREADY_EXISTS;
+                return nullptr;
+            }
+
+            // Check we are not going to overwrite an existing db file
+            if (fs::exists(wallet_file)) {
+                error = Untranslated(strprintf("Failed to restore wallet. Database file exists in '%s'.", fs::PathToString(wallet_file)));
+                status = DatabaseStatus::FAILED_ALREADY_EXISTS;
+                return nullptr;
+            }
+        } else {
+            // The directory doesn't exist, create it
+            if (!TryCreateDirectories(wallet_path)) {
+                error = Untranslated(strprintf("Failed to restore database path '%s'.", fs::PathToString(wallet_path)));
+                status = DatabaseStatus::FAILED_ALREADY_EXISTS;
+                return nullptr;
+            }
+            created_parent_dir = true;
         }
 
-        created_parent_dir = true;
         fs::copy_file(backup_file, wallet_file, fs::copy_options::none);
+        wallet_file_copied = true;
 
         wallet = LoadWallet(context, wallet_name, load_on_start, options, status, error, warnings);
     } catch (const std::exception& e) {
@@ -539,8 +561,19 @@ std::shared_ptr<CWallet> RestoreWallet(WalletContext& context, const fs::path& b
         error += strprintf(Untranslated("Unexpected exception: %s"), e.what());
         status = DatabaseStatus::FAILED_LOAD;
     }
-    if (!wallet && created_parent_dir) {
-        fs::remove_all(wallet_path);
+
+    // Remove created wallet path only when loading fails
+    if (!wallet) {
+        if (wallet_file_copied) fs::remove(wallet_file);
+        // Clean up the parent directory if we created it during restoration.
+        // Verifying a corrupt BDB file leaves its environment files (db.log,
+        // .walletlock, database/) next to the wallet file, so the directory is
+        // not necessarily empty. It did not exist before this call, so removing
+        // it recursively only touches what this restore created.
+        // TODO(bitcoin#28710): once BDB is gone nothing but wallet.dat can be
+        //       created here; restore upstream's `Assume(fs::is_empty(wallet_path));
+        //       fs::remove(wallet_path);` (bitcoin#34156, 4ed0693a3f).
+        if (created_parent_dir) fs::remove_all(wallet_path);
     }
 
     return wallet;
@@ -636,15 +669,20 @@ bool CWallet::ChangeWalletPassphrase(const SecureString& strOldWalletPassphrase,
     return false;
 }
 
-void CWallet::chainStateFlushed(const CBlockLocator& loc)
+void CWallet::SetLastBlockProcessedInMem(int block_height, uint256 block_hash)
 {
-    // Don't update the best block until the chain is attached so that in case of a shutdown,
-    // the rescan will be restarted at next startup.
-    if (m_attaching_chain) {
-        return;
-    }
-    WalletBatch batch(GetDatabase());
-    batch.WriteBestBlock(loc);
+    AssertLockHeld(cs_wallet);
+
+    m_last_block_processed = block_hash;
+    m_last_block_processed_height = block_height;
+}
+
+void CWallet::SetLastBlockProcessed(int block_height, uint256 block_hash)
+{
+    AssertLockHeld(cs_wallet);
+
+    SetLastBlockProcessedInMem(block_height, block_hash);
+    WriteBestBlock();
 }
 
 void CWallet::SetMinVersion(enum WalletFeature nVersion, WalletBatch* batch_in)
@@ -1389,11 +1427,14 @@ void CWallet::MarkConflicted(const uint256& hashBlock, int conflicting_height, c
 {
     LOCK(cs_wallet);
 
-    int conflictconfirms = (m_last_block_processed_height - conflicting_height + 1) * -1;
     // If number of conflict confirms cannot be determined, this means
     // that the block is still unknown or not yet part of the main chain,
     // for example when loading the wallet during a reindex. Do nothing in that
     // case.
+    if (m_last_block_processed_height < 0 || conflicting_height < 0) {
+        return;
+    }
+    int conflictconfirms = (m_last_block_processed_height - conflicting_height + 1) * -1;
     if (conflictconfirms >= 0)
         return;
 
@@ -1458,10 +1499,10 @@ void CWallet::RecursiveUpdateTxState(const uint256& tx_hash, const TryUpdatingSt
     fAnonymizableTallyCachedNonDenom = false;
 }
 
-void CWallet::SyncTransaction(const CTransactionRef& ptx, const SyncTxState& state, WalletBatch& batch, bool update_tx, bool rescanning_old_block)
+bool CWallet::SyncTransaction(const CTransactionRef& ptx, const SyncTxState& state, WalletBatch& batch, bool update_tx, bool rescanning_old_block)
 {
     if (!AddToWalletIfInvolvingMe(ptx, state, batch, update_tx, rescanning_old_block))
-        return; // Not one of ours
+        return false; // Not one of ours
 
     // If a transaction changes 'conflicted' state, that changes the balance
     // available of the outputs it spends. So force those to be
@@ -1470,6 +1511,7 @@ void CWallet::SyncTransaction(const CTransactionRef& ptx, const SyncTxState& sta
 
     fAnonymizableTallyCached = false;
     fAnonymizableTallyCachedNonDenom = false;
+    return true;
 }
 
 void CWallet::transactionAddedToMempool(const CTransactionRef& tx, int64_t nAcceptTime) {
@@ -1534,14 +1576,22 @@ void CWallet::blockConnected(const interfaces::BlockInfo& block)
     assert(block.data);
     LOCK(cs_wallet);
 
-    m_last_block_processed_height = block.height;
-    m_last_block_processed = block.hash;
+    // Update the best block in memory first. This will set the best block's height, which is
+    // needed by MarkConflicted.
+    SetLastBlockProcessedInMem(block.height, block.hash);
+
     WalletBatch batch(GetDatabase());
+    bool wallet_updated = false;
     for (size_t index = 0; index < block.data->vtx.size(); index++) {
-        SyncTransaction(block.data->vtx[index], TxStateConfirmed{block.hash, block.height, static_cast<int>(index)}, batch);
+        wallet_updated |= SyncTransaction(block.data->vtx[index], TxStateConfirmed{block.hash, block.height, static_cast<int>(index)}, batch);
         transactionRemovedFromMempool(block.data->vtx[index], MemPoolRemovalReason::BLOCK);
     }
 
+    // Update on disk if this block resulted in us updating a tx, or periodically every 144 blocks (~1 day)
+    if (wallet_updated || block.height % 144 == 0) {
+        WriteBestBlock();
+    }
+
     // reset cache to make sure no longer immature coins are included
     fAnonymizableTallyCached = false;
     fAnonymizableTallyCachedNonDenom = false;
@@ -1556,9 +1606,6 @@ void CWallet::blockDisconnected(const interfaces::BlockInfo& block)
     // be unconfirmed, whether or not the transaction is added back to the mempool.
     // User may have to call abandontransaction again. It may be addressed in the
     // future with a stickier abandoned state or even removing abandontransaction call.
-    m_last_block_processed_height = block.height - 1;
-    m_last_block_processed = *Assert(block.prev_hash);
-
     int disconnect_height = block.height;
 
     WalletBatch batch(GetDatabase());
@@ -1594,6 +1641,9 @@ void CWallet::blockDisconnected(const interfaces::BlockInfo& block)
     // reset cache to make sure no longer mature coins are excluded
     fAnonymizableTallyCached = false;
     fAnonymizableTallyCachedNonDenom = false;
+
+    // Update the best block
+    SetLastBlockProcessed(block.height - 1, *Assert(block.prev_hash));
 }
 
 void CWallet::updatedBlockTip()
@@ -2505,7 +2555,7 @@ DBErrors CWallet::LoadWallet()
     if (HaveChain()) {
         const std::optional<int> tip_height = chain().getHeight();
         if (tip_height) {
-            SetLastBlockProcessed(*tip_height, chain().getBlockHash(*tip_height));
+            SetLastBlockProcessedInMem(*tip_height, chain().getBlockHash(*tip_height));
             for (auto& pair : mapWallet) {
                 for(unsigned int i = 0; i < pair.second.tx->vout.size(); ++i) {
                     COutPoint outpoint(pair.first, i);
@@ -3240,6 +3290,8 @@ std::shared_ptr<CWallet> CWallet::Create(WalletContext& context, const std::stri
                      !walletInstance->IsWalletFlagSet(WALLET_FLAG_BLANK_WALLET);
     if (fFirstRun)
     {
+        LOCK(walletInstance->cs_wallet);
+
         walletInstance->SetMinVersion(FEATURE_LATEST);
 
         walletInstance->InitWalletFlags(wallet_creation_flags);
@@ -3267,7 +3319,6 @@ std::shared_ptr<CWallet> CWallet::Create(WalletContext& context, const std::stri
                     }
                     // add default account
                     newHdChain.AddAccount();
-                    LOCK(walletInstance->cs_wallet);
                     if (auto spk_man = walletInstance->GetLegacyScriptPubKeyMan()) {
                         if (!spk_man->AddHDChainSingle(newHdChain)) {
                             error = strprintf(_("%s failed"), "AddHDChainSingle");
@@ -3286,7 +3337,6 @@ std::shared_ptr<CWallet> CWallet::Create(WalletContext& context, const std::stri
 
                     mnemonic = args.GetArg("-mnemonic", "");
                     mnemonic_passphrase = args.GetArg("-mnemonicpassphrase", "");
-                    LOCK(walletInstance->cs_wallet);
                     if (auto spk_man = walletInstance->GetLegacyScriptPubKeyMan()) {
                         spk_man->GenerateNewHDChain(mnemonic, mnemonic_passphrase);
                     }
@@ -3298,7 +3348,6 @@ std::shared_ptr<CWallet> CWallet::Create(WalletContext& context, const std::stri
                 args.ForceRemoveArg("mnemonicpassphrase");
             } // Otherwise, do not create a new HD chain
 
-            LOCK(walletInstance->cs_wallet);
             if (walletInstance->IsWalletFlagSet(WALLET_FLAG_DESCRIPTORS)) {
                 SecureString mnemonic, mnemonic_passphrase;
                 mnemonic.reserve(256);
@@ -3321,7 +3370,10 @@ std::shared_ptr<CWallet> CWallet::Create(WalletContext& context, const std::stri
         }
 
         if (chain) {
-            walletInstance->chainStateFlushed(chain->getTipLocator());
+            std::optional<int> tip_height = chain->getHeight();
+            if (tip_height) {
+                walletInstance->SetLastBlockProcessed(*tip_height, chain->getBlockHash(*tip_height));
+            }
         }
 
         // Try to create wallet backup right after new wallet was created
@@ -3530,16 +3582,11 @@ bool CWallet::AttachChain(const std::shared_ptr<CWallet>& walletInstance, interf
     }
 
     // Register wallet with validationinterface. It's done before rescan to avoid
-    // missing block connections between end of rescan and validation subscribing.
-    // Because of wallet lock being hold, block connection notifications are going to
-    // be pending on the validation-side until lock release. It's likely to have
-    // block processing duplicata (if rescan block range overlaps with notification one)
-    // but we guarantee at least than wallet state is correct after notifications delivery.
-    // However, chainStateFlushed notifications are ignored until the rescan is finished
-    // so that in case of a shutdown event, the rescan will be repeated at the next start.
-    // This is temporary until rescan and notifications delivery are unified under same
-    // interface.
-    walletInstance->m_attaching_chain = true; //ignores chainStateFlushed notifications
+    // missing block connections during the rescan.
+    // Because of the wallet lock being held, block connection notifications are going to
+    // be pending on the validation-side until lock release. Blocks that are connected while the
+    // rescan is ongoing will not be processed in the rescan but with the block connected notifications,
+    // so the wallet will only be completeley synced after the notifications delivery.
     walletInstance->m_chain_notifications_handler = walletInstance->chain().handleNotifications(walletInstance);
 
     // If rescan_required = true, rescan_height remains equal to 0
@@ -3557,11 +3604,9 @@ bool CWallet::AttachChain(const std::shared_ptr<CWallet>& walletInstance, interf
 
     const std::optional<int> tip_height = chain.getHeight();
     if (tip_height) {
-        walletInstance->m_last_block_processed = chain.getBlockHash(*tip_height);
-        walletInstance->m_last_block_processed_height = *tip_height;
+        walletInstance->SetLastBlockProcessedInMem(*tip_height, chain.getBlockHash(*tip_height));
     } else {
-        walletInstance->m_last_block_processed.SetNull();
-        walletInstance->m_last_block_processed_height = -1;
+        walletInstance->SetLastBlockProcessedInMem(-1, uint256());
     }
 
     if (tip_height && *tip_height != rescan_height)
@@ -3620,16 +3665,22 @@ bool CWallet::AttachChain(const std::shared_ptr<CWallet>& walletInstance, interf
         walletInstance->WalletLogPrintf("Rescanning last %i blocks (from block %i)...\n", *tip_height - rescan_height, rescan_height);
         {
             WalletRescanReserver reserver(*walletInstance);
-            if (!reserver.reserve() || (ScanResult::SUCCESS != walletInstance->ScanForWalletTransactions(chain.getBlockHash(rescan_height), rescan_height, /*max_height=*/{}, reserver, /*fUpdate=*/true, /*save_progress=*/true).status)) {
+            if (!reserver.reserve()) {
+                error = _("Failed to acquire rescan reserver during wallet initialization");
+                return false;
+            }
+            ScanResult scan_res = walletInstance->ScanForWalletTransactions(chain.getBlockHash(rescan_height), rescan_height, /*max_height=*/{}, reserver, /*fUpdate=*/true, /*save_progress=*/true);
+            if (ScanResult::SUCCESS != scan_res.status) {
                 error = _("Failed to rescan the wallet during initialization");
                 return false;
             }
+            // Set and update the best block record
+            // Set last block scanned as the last block processed as it may be different in case of a reorg.
+            // Also save the best block locator because rescanning only updates it intermittently.
+            walletInstance->SetLastBlockProcessed(*scan_res.last_scanned_height, scan_res.last_scanned_block);
         }
-        walletInstance->m_attaching_chain = false;
-        walletInstance->chainStateFlushed(chain.getTipLocator());
         walletInstance->GetDatabase().IncrementUpdateCounter();
     }
-    walletInstance->m_attaching_chain = false;
 
     return true;
 }
@@ -3688,6 +3739,8 @@ void CWallet::InitAutoBackup()
 
 bool CWallet::BackupWallet(const std::string& strDest) const
 {
+    // TODO: bitcoin#30678 added a best block write here that bitcoin#30221 then replaced with this call; drop its hunk when backporting it
+    WITH_LOCK(cs_wallet, WriteBestBlock());
     return GetDatabase().Backup(strDest);
 }
 
@@ -4744,9 +4797,36 @@ bool CWallet::ApplyMigrationData(MigrationData& data, bilingual_str& error)
         }
     }
 
+    // Get best block locator so that we can copy it to the watchonly and solvables
+    CBlockLocator best_block_locator;
+    if (!WalletBatch(GetDatabase()).ReadBestBlock(best_block_locator)) {
+        error = _("Error: Unable to read wallet's best block locator record");
+        return false;
+    }
+
     // Check if the transactions in the wallet are still ours. Either they belong here, or they belong in the watchonly wallet.
     // We need to go through these in the tx insertion order so that lookups to spends works.
     std::vector<uint256> txids_to_delete;
+    std::unique_ptr<WalletBatch> watchonly_batch;
+    if (data.watchonly_wallet) {
+        watchonly_batch = std::make_unique<WalletBatch>(data.watchonly_wallet->GetDatabase());
+        // Copy the next tx order pos to the watchonly wallet
+        LOCK(data.watchonly_wallet->cs_wallet);
+        data.watchonly_wallet->nOrderPosNext = nOrderPosNext;
+        watchonly_batch->WriteOrderPosNext(data.watchonly_wallet->nOrderPosNext);
+        // Write the best block locator to avoid rescanning on reload
+        if (!watchonly_batch->WriteBestBlock(best_block_locator)) {
+            error = _("Error: Unable to write watchonly wallet best block locator record");
+            return false;
+        }
+    }
+    if (data.solvable_wallet) {
+        // Write the best block locator to avoid rescanning on reload
+        if (!WalletBatch(data.solvable_wallet->GetDatabase()).WriteBestBlock(best_block_locator)) {
+            error = _("Error: Unable to write solvable wallet best block locator record");
+            return false;
+        }
+    }
     for (const auto& [_pos, wtx] : wtxOrdered) {
         // Check it is the watchonly wallet's
         // solvable_wallet doesn't need to be checked because transactions for those scripts weren't being watched for
@@ -4755,13 +4835,21 @@ bool CWallet::ApplyMigrationData(MigrationData& data, bilingual_str& error)
             LOCK(data.watchonly_wallet->cs_wallet);
             if (data.watchonly_wallet->IsMine(*wtx->tx) || data.watchonly_wallet->IsFromMe(*wtx->tx)) {
                 // Add to watchonly wallet
-                if (!data.watchonly_wallet->AddToWallet(wtx->tx, wtx->m_state)) {
-                    error = _("Error: Could not add watchonly tx to watchonly wallet");
+                const uint256& hash = wtx->GetHash();
+                const CWalletTx& to_copy_wtx = *wtx;
+                if (!data.watchonly_wallet->LoadToWallet(hash, [&](CWalletTx& ins_wtx, bool new_tx) EXCLUSIVE_LOCKS_REQUIRED(data.watchonly_wallet->cs_wallet) {
+                    if (!new_tx) return false;
+                    ins_wtx.SetTx(to_copy_wtx.tx);
+                    ins_wtx.CopyFrom(to_copy_wtx);
+                    return true;
+                })) {
+                    error = strprintf(_("Error: Could not add watchonly tx %s to watchonly wallet"), wtx->GetHash().GetHex());
                     return false;
                 }
+                watchonly_batch->WriteTx(data.watchonly_wallet->mapWallet.at(hash));
                 // Mark as to remove from the migrated wallet only if it does not also belong to it
                 if (!is_mine) {
-                    txids_to_delete.push_back(wtx->GetHash());
+                    txids_to_delete.push_back(hash);
                 }
                 continue;
             }
@@ -4772,6 +4860,7 @@ bool CWallet::ApplyMigrationData(MigrationData& data, bilingual_str& error)
             return false;
         }
     }
+    watchonly_batch.reset(); // Flush
     // Do the removes
     if (txids_to_delete.size() > 0) {
         std::vector<uint256> deleted_txids;
@@ -4834,7 +4923,7 @@ bool CWallet::ApplyMigrationData(MigrationData& data, bilingual_str& error)
                 return false;
             }
         } else {
-            // Labels for everything else (send) should be cloned to all
+            // Labels for everything else ("send") should be cloned to all
             if (data.watchonly_wallet) {
                 LOCK(data.watchonly_wallet->cs_wallet);
                 // Add to the watchonly. Preserve the labels, purpose, and change-ness
@@ -4843,7 +4932,6 @@ bool CWallet::ApplyMigrationData(MigrationData& data, bilingual_str& error)
                 if (!addr_pair.second.IsChange()) {
                     data.watchonly_wallet->m_address_book[addr_pair.first].SetLabel(label);
                 }
-                continue;
             }
             if (data.solvable_wallet) {
                 LOCK(data.solvable_wallet->cs_wallet);
@@ -4853,7 +4941,6 @@ bool CWallet::ApplyMigrationData(MigrationData& data, bilingual_str& error)
                 if (!addr_pair.second.IsChange()) {
                     data.solvable_wallet->m_address_book[addr_pair.first].SetLabel(label);
                 }
-                continue;
             }
         }
     }
@@ -4864,10 +4951,10 @@ bool CWallet::ApplyMigrationData(MigrationData& data, bilingual_str& error)
         WalletBatch batch{wallet.GetDatabase()};
         for (const auto& [destination, addr_book_data] : wallet.m_address_book) {
             auto address{EncodeDestination(destination)};
-            auto label{addr_book_data.GetLabel()};
-            // don't bother writing default values (unknown purpose, empty label)
+            std::optional<std::string> label = addr_book_data.IsChange() ? std::nullopt : std::make_optional(addr_book_data.GetLabel());
+            // don't bother writing default values (unknown purpose)
             if (addr_book_data.purpose) batch.WritePurpose(address, PurposeToString(*addr_book_data.purpose));
-            if (!label.empty()) batch.WriteName(address, label);
+            if (label) batch.WriteName(address, *label);
         }
     };
     if (data.watchonly_wallet) persist_address_book(*data.watchonly_wallet);
@@ -4892,6 +4979,15 @@ bool CWallet::ApplyMigrationData(MigrationData& data, bilingual_str& error)
     return true;
 }
 
+// Returns wallet prefix for migration.
+// Used to name the backup file and newly created wallets.
+// E.g. a watch-only wallet is named "<prefix>_watchonly".
+static std::string MigrationPrefixName(CWallet& wallet)
+{
+    const std::string& name{wallet.GetName()};
+    return name.empty() ? "default_wallet" : name;
+}
+
 bool DoMigration(CWallet& wallet, WalletContext& context, bilingual_str& error, MigrationResult& res) EXCLUSIVE_LOCKS_REQUIRED(wallet.cs_wallet)
 {
     AssertLockHeld(wallet.cs_wallet);
@@ -4905,6 +5001,10 @@ bool DoMigration(CWallet& wallet, WalletContext& context, bilingual_str& error,
         DatabaseOptions options;
         options.require_existing = false;
         options.require_create = true;
+        options.require_format = DatabaseFormat::SQLITE;
+
+        WalletContext empty_context;
+        empty_context.args = context.args;
 
         // Make the wallets
         options.create_flags = WALLET_FLAG_DISABLE_PRIVATE_KEYS | WALLET_FLAG_BLANK_WALLET | WALLET_FLAG_DESCRIPTORS;
@@ -4919,9 +5019,15 @@ bool DoMigration(CWallet& wallet, WalletContext& context, bilingual_str& error,
 
             DatabaseStatus status;
             std::vector<bilingual_str> warnings;
-            std::string wallet_name = wallet.GetName() + "_watchonly";
-            data->watchonly_wallet = CreateWallet(context, wallet_name, std::nullopt, options, status, error, warnings);
-            if (status != DatabaseStatus::SUCCESS) {
+            std::string wallet_name = MigrationPrefixName(wallet) + "_watchonly";
+            std::unique_ptr<WalletDatabase> database = MakeWalletDatabase(wallet_name, options, status, error);
+            if (!database) {
+                error = strprintf(_("Wallet file creation failed: %s"), error);
+                return false;
+            }
+
+            data->watchonly_wallet = CWallet::Create(empty_context, wallet_name, std::move(database), options.create_flags, error, warnings);
+            if (!data->watchonly_wallet) {
                 error = _("Error: Failed to create new watchonly wallet");
                 return false;
             }
@@ -4950,9 +5056,15 @@ bool DoMigration(CWallet& wallet, WalletContext& context, bilingual_str& error,
 
             DatabaseStatus status;
             std::vector<bilingual_str> warnings;
-            std::string wallet_name = wallet.GetName() + "_solvables";
-            data->solvable_wallet = CreateWallet(context, wallet_name, std::nullopt, options, status, error, warnings);
-            if (status != DatabaseStatus::SUCCESS) {
+            std::string wallet_name = MigrationPrefixName(wallet) + "_solvables";
+            std::unique_ptr<WalletDatabase> database = MakeWalletDatabase(wallet_name, options, status, error);
+            if (!database) {
+                error = strprintf(_("Wallet file creation failed: %s"), error);
+                return false;
+            }
+
+            data->solvable_wallet = CWallet::Create(empty_context, wallet_name, std::move(database), options.create_flags, error, warnings);
+            if (!data->solvable_wallet) {
                 error = _("Error: Failed to create new watchonly wallet");
                 return false;
             }
@@ -4994,6 +5106,7 @@ util::Result<MigrationResult> MigrateLegacyToDescriptor(const std::string& walle
     // If the wallet is still loaded, unload it so that nothing else tries to use it while we're changing it
     bool was_loaded = false;
     if (auto wallet = GetWallet(context, wallet_name)) {
+        // TODO: bitcoin#30678 flushed the best block here; RemoveWallet() writes it since bitcoin#30221, drop that hunk when backporting it
         if (!RemoveWallet(context, wallet, /*load_on_start=*/std::nullopt, warnings)) {
             return util::Error{_("Unable to unload the wallet before migrating")};
         }
@@ -5025,7 +5138,12 @@ util::Result<MigrationResult> MigrateLegacyToDescriptor(const std::string& walle
         std::string name = to_reload->GetName();
         to_reload.reset();
         to_reload = LoadWallet(context, name, /*load_on_start=*/std::nullopt, options, status, error, warnings);
-        return to_reload != nullptr;
+        if (!to_reload) {
+            LogError("Failed to load wallet '%s' after migration. Rolling back migration to preserve consistency. "
+                     "Error cause: %s\n", name, error.original);
+            return false;
+        }
+        return true;
     };
 
     // Before anything else, check if there is something to migrate.
@@ -5038,10 +5156,13 @@ util::Result<MigrationResult> MigrateLegacyToDescriptor(const std::string& walle
 
     // Make a backup of the DB in the wallet's directory with a unique filename
     // based on the wallet name and current timestamp. The backup filename uses
-    // the basename of the wallet path (or "wallet" if the name is blank) so that
-    // path-style wallet names cannot escape the wallet directory.
-    // TODO: backport bitcoin/bitcoin#32273 to also move the backup into the
-    //       top-level walletdir and unify with upstream.
+    // the basename of the wallet path (or "default_wallet" if the name is blank)
+    // so that path-style wallet names cannot escape the wallet directory.
+    // TODO(bitcoin#32273): backups move to the top-level walletdir and are named
+    //       from the wallet path. When backported, drop the basename reduction
+    //       below, replace test_wallet_name_with_slashes with upstream's path
+    //       tests, re-derive the bitcoin#34226 path cases from master, then
+    //       take bitcoin#33104 and bitcoin#33122.
     fs::path this_wallet_dir = fs::absolute(fs::PathFromString(local_wallet->GetDatabase().Filename())).parent_path();
     std::string backup_prefix;
     if (!wallet_name.empty()) {
@@ -5050,9 +5171,9 @@ util::Result<MigrationResult> MigrateLegacyToDescriptor(const std::string& walle
         backup_prefix = fs::PathToString(legacy_wallet_path.filename());
     }
     // Fall back when the name was blank or canonicalizes to an empty filename
-    // (e.g. "/", "."), so we never emit a file like "-1748432384.legacy.bak".
-    if (backup_prefix.empty()) backup_prefix = "wallet";
-    fs::path backup_filename = fs::PathFromString(strprintf("%s-%d.legacy.bak", backup_prefix, GetTime()));
+    // (e.g. "/", "."), so we never emit a file like "_1748432384.legacy.bak".
+    if (backup_prefix.empty()) backup_prefix = MigrationPrefixName(*local_wallet);
+    fs::path backup_filename = fs::PathFromString(strprintf("%s_%d.legacy.bak", backup_prefix, GetTime()));
     fs::path backup_path = this_wallet_dir / backup_filename;
     if (!local_wallet->BackupWallet(fs::PathToString(backup_path))) {
         if (was_loaded) {
@@ -5085,68 +5206,140 @@ util::Result<MigrationResult> MigrateLegacyToDescriptor(const std::string& walle
         // First change to using SQLite
         if (!local_wallet->MigrateToSQLite(error)) return util::Error{error};
 
+        // In case we're migrating from file to directory, move the backup into it
+        // TODO(bitcoin#32273): this block exists only on the 28.x/29.x branches. Remove
+        //       it together with the backup naming TODO above: once backups live in
+        //       the top-level walletdir they never need to be moved.
+        this_wallet_dir = fs::absolute(fs::PathFromString(local_wallet->GetDatabase().Filename())).parent_path();
+        backup_path = this_wallet_dir / backup_filename;
+        fs::rename(res.backup_path, backup_path);
+        res.backup_path = backup_path;
+
         // Do the migration, and cleanup if it fails
         success = DoMigration(*local_wallet, context, error, res);
     }
 
+    // In case of loading failure, we need to remember the wallet files we have created to remove.
+    // A `set` is used as it may be populated with the same wallet directory paths multiple times,
+    // both before and after loading. This ensures the set is complete even if one of the wallets
+    // fails to load.
+    std::set<fs::path> wallet_files_to_remove;
+    std::set<fs::path> wallet_empty_dirs_to_remove;
+
+    // Helper to track wallet files and directories for cleanup on failure.
+    // Only directories of wallets created during migration (not the main wallet) are tracked.
+    auto track_for_cleanup = [&](const CWallet& wallet) {
+        const auto files = wallet.GetDatabase().Files();
+        wallet_files_to_remove.insert(files.begin(), files.end());
+        if (wallet.GetName() != wallet_name) {
+            // If this isn’t the main wallet, mark its directory for removal.
+            // This applies to the watch-only and solvable wallets.
+            // Wallets stored directly as files in the top-level directory
+            // (e.g. default unnamed wallets) don’t have a removable parent directory.
+            wallet_empty_dirs_to_remove.insert(fs::PathFromString(wallet.GetDatabase().Filename()).parent_path());
+        }
+    };
+
+
     if (success) {
-        // Migration successful, unload the wallet locally, then reload it.
-        assert(local_wallet.use_count() == 1);
-        local_wallet.reset();
-        res.wallet = LoadWallet(context, wallet_name, /*load_on_start=*/std::nullopt, options, status, error, warnings);
+        // Migration successful, unload all wallets locally, then reload them.
+        // Reload the main wallet
+        LogInfo("Loading new wallets after migration...\n");
+        track_for_cleanup(*local_wallet);
+        success = reload_wallet(local_wallet);
+        res.wallet = local_wallet;
         res.wallet_name = wallet_name;
-    } else {
+        if (success && res.watchonly_wallet) {
+            // Reload watchonly
+            track_for_cleanup(*res.watchonly_wallet);
+            success = reload_wallet(res.watchonly_wallet);
+        }
+        if (success && res.solvables_wallet) {
+            // Reload solvables
+            track_for_cleanup(*res.solvables_wallet);
+            success = reload_wallet(res.solvables_wallet);
+        }
+    }
+    if (!success) {
         // Migration failed, cleanup
-        // Copy the backup to the actual wallet dir
-        fs::path temp_backup_location = fsbridge::AbsPathJoin(GetWalletDir(), backup_filename);
-        fs::copy_file(backup_path, temp_backup_location, fs::copy_options::none);
 
-        // Remember this wallet's walletdir to remove after unloading
-        std::vector<fs::path> wallet_dirs;
-        wallet_dirs.emplace_back(fs::PathFromString(local_wallet->GetDatabase().Filename()).parent_path());
-
-        // Unload the wallet locally
-        assert(local_wallet.use_count() == 1);
-        local_wallet.reset();
+        // Drop the second reference to the reloaded main wallet: UnloadWallet() below
+        // waits until the last reference is gone, and this one would only die on return.
+        // Dash-only: upstream 28.x/29.x carry the same latent hang when a watch-only or
+        // solvables reload fails after the main wallet reloaded, and master only moves
+        // the pointer into res.wallet, which then skips the rollback instead.
+        res.wallet.reset();
 
         // Make list of wallets to cleanup
         std::vector<std::shared_ptr<CWallet>> created_wallets;
+        if (local_wallet) created_wallets.push_back(std::move(local_wallet));
         if (res.watchonly_wallet) created_wallets.push_back(std::move(res.watchonly_wallet));
         if (res.solvables_wallet) created_wallets.push_back(std::move(res.solvables_wallet));
 
         // Get the directories to remove after unloading
-        for (std::shared_ptr<CWallet>& w : created_wallets) {
-            wallet_dirs.emplace_back(fs::PathFromString(w->GetDatabase().Filename()).parent_path());
+        for (std::shared_ptr<CWallet>& wallet : created_wallets) {
+            track_for_cleanup(*wallet);
         }
 
         // Unload the wallets
         for (std::shared_ptr<CWallet>& w : created_wallets) {
-            if (!RemoveWallet(context, w, /*load_on_start=*/false)) {
-                error += _("\nUnable to cleanup failed migration");
-                return util::Error{error};
+            if (w->HaveChain()) {
+                // Unloading for wallets that were loaded for normal use
+                if (!RemoveWallet(context, w, /*load_on_start=*/false)) {
+                    error += _("\nUnable to cleanup failed migration");
+                    return util::Error{error};
+                }
+                UnloadWallet(std::move(w));
+            } else {
+                // Unloading for wallets in local context
+                assert(w.use_count() == 1);
+                w.reset();
             }
-            UnloadWallet(std::move(w));
         }
 
-        // Delete the wallet directories
-        for (fs::path& dir : wallet_dirs) {
-            fs::remove_all(dir);
+        // First, delete the db files we have created throughout this process and nothing else
+        for (const fs::path& file : wallet_files_to_remove) {
+            fs::remove(file);
+        }
+
+        // Second, delete the created wallet directories and nothing else. They must be empty at this point.
+        for (const fs::path& dir : wallet_empty_dirs_to_remove) {
+            Assume(fs::is_empty(dir));
+            fs::remove(dir);
         }
 
         // Restore the backup
-        DatabaseStatus status;
-        std::vector<bilingual_str> warnings;
-        if (!RestoreWallet(context, temp_backup_location, wallet_name, /*load_on_start=*/std::nullopt, status, error, warnings)) {
-            error += _("\nUnable to restore backup of wallet.");
+        // Convert the backup file to the wallet db file by renaming it and moving it into the wallet's directory.
+        // Reload it into memory if the wallet was previously loaded.
+        // TODO(bitcoin#31451): RestoreWallet loads the wallet even when it was not loaded
+        //       before migration. When backporting bitcoin#31451, add its load_after_restore
+        //       parameter to RestoreWallet, pass was_loaded here, assert that the wallet is
+        //       reloaded only if was_loaded, and re-derive this function from the 29.x commits
+        //       d91f56e1e3 and a074d36254 (bitcoin#34222), which already have that shape.
+        bilingual_str restore_error;
+        const auto& ptr_wallet = RestoreWallet(context, backup_path, wallet_name, /*load_on_start=*/std::nullopt, status, restore_error, warnings);
+        if (!restore_error.empty()) {
+            error += restore_error + _("\nUnable to restore backup of wallet.");
             return util::Error{error};
         }
 
-        // Move the backup to the wallet dir
-        fs::copy_file(temp_backup_location, backup_path, fs::copy_options::none);
-        fs::remove(temp_backup_location);
-
         return util::Error{error};
     }
     return res;
 }
+
+void CWallet::WriteBestBlock() const
+{
+    AssertLockHeld(cs_wallet);
+
+    if (!m_last_block_processed.IsNull()) {
+        CBlockLocator loc;
+        chain().findBlock(m_last_block_processed, FoundBlock().locator(loc));
+
+        if (!loc.IsNull()) {
+            WalletBatch batch(GetDatabase());
+            batch.WriteBestBlock(loc);
+        }
+    }
+}
 } // namespace wallet
diff --git a/src/wallet/wallet.h b/src/wallet/wallet.h
index 98b0ba3e7b97..a01922daae71 100644
--- a/src/wallet/wallet.h
+++ b/src/wallet/wallet.h
@@ -331,7 +331,6 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
 
     std::atomic<bool> fAbortRescan{false}; // reset by WalletRescanReserver::reserve()
     std::atomic<bool> fScanningWallet{false}; // controlled by WalletRescanReserver
-    std::atomic<bool> m_attaching_chain{false};
     std::atomic<bool> m_scanning_with_passphrase{false};
     std::atomic<SteadyClock::time_point> m_scanning_start{SteadyClock::time_point{}};
     std::atomic<double> m_scanning_progress{0};
@@ -418,7 +417,7 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
 
     void SyncMetaData(std::pair<TxSpends::iterator, TxSpends::iterator>) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
 
-    void SyncTransaction(const CTransactionRef& tx, const SyncTxState& state, WalletBatch& batch, bool update_tx = true, bool rescanning_old_block = false) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
+    bool SyncTransaction(const CTransactionRef& tx, const SyncTxState& state, WalletBatch& batch, bool update_tx = true, bool rescanning_old_block = false) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
 
     /** WalletFlags set on this wallet. */
     std::atomic<uint64_t> m_wallet_flags{0};
@@ -498,6 +497,9 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
 
     static NodeClock::time_point GetDefaultNextResend();
 
+    // Update last block processed in memory only
+    void SetLastBlockProcessedInMem(int block_height, uint256 block_hash) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
+
     PlatformKeyStatus GetPlatformKeySource(const ScriptPubKeyMan*& source) const EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
     PlatformKeyStatus DerivePlatformKey(const PlatformKeyRequest& request, platformkeys::ExtKey256& out) const
         EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
@@ -961,7 +963,6 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     /** should probably be renamed to IsRelevantToMe */
     bool IsFromMe(const CTransaction& tx) const;
     CAmount GetDebit(const CTransaction& tx, const isminefilter& filter) const;
-    void chainStateFlushed(const CBlockLocator& loc) override;
 
     DBErrors LoadWallet();
     void AutoLockMasternodeCollaterals();
@@ -1193,13 +1194,10 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
         assert(m_last_block_processed_height >= 0);
         return m_last_block_processed;
     }
-    /** Set last block processed height, currently only use in unit test */
-    void SetLastBlockProcessed(int block_height, uint256 block_hash) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet)
-    {
-        AssertLockHeld(cs_wallet);
-        m_last_block_processed_height = block_height;
-        m_last_block_processed = block_hash;
-    };
+    /** Set last block processed height, and write to database */
+    void SetLastBlockProcessed(int block_height, uint256 block_hash) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
+    /** Write the current best block to database */
+    void WriteBestBlock() const EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
 
     //! Connect the signals from ScriptPubKeyMans to the signals in CWallet
     void ConnectScriptPubKeyManNotifiers();
diff --git a/test/functional/feature_addressindex.py b/test/functional/feature_addressindex.py
index 8986d4a15930..e14c23de942e 100755
--- a/test/functional/feature_addressindex.py
+++ b/test/functional/feature_addressindex.py
@@ -19,7 +19,8 @@
     keyhash_to_p2pkh_script,
     scripthash_to_p2sh_script,
 )
-from test_framework.util import assert_equal
+from test_framework.util import assert_equal, assert_greater_than
+from test_framework.wallet import getnewdestination
 
 class AddressIndexTest(BitcoinTestFramework):
     def add_options(self, parser):
@@ -341,8 +342,31 @@ def run_test(self):
         mempool_deltas = self.nodes[2].getaddressmempool({"addresses": [address1]})
         assert_equal(len(mempool_deltas), 2)
 
+        self.test_reorg_while_disabled()
+
         self.log.info("Passed")
 
+    def wait_index_synced(self, node):
+        self.wait_until(lambda: node.getindexinfo()["addressindex"] == {"synced": True, "best_block_height": node.getblockcount()})
+
+    def test_reorg_while_disabled(self):
+        self.log.info("Test that blocks orphaned while the index was disabled are removed from it")
+        node = self.nodes[3]
+        self.disconnect_nodes(0, 3)
+        orphan_address = getnewdestination()[2]
+        orphan_block = self.generatetoaddress(node, 1, orphan_address, sync_fun=self.no_op)[0]
+        self.wait_index_synced(node)
+        assert_greater_than(node.getaddressbalance(orphan_address)["received"], 0)
+
+        self.restart_node(3, ["-addressindex=0"])
+        node.invalidateblock(orphan_block)
+        self.generatetoaddress(node, 2, getnewdestination()[2], sync_fun=self.no_op)
+
+        self.restart_node(3, ["-addressindex"])
+        self.wait_index_synced(node)
+        assert_equal(node.getaddressbalance(orphan_address)["received"], 0)
+        assert_equal(node.getaddresstxids(orphan_address), [])
+
 
 if __name__ == '__main__':
     AddressIndexTest().main()
diff --git a/test/functional/feature_coinstatsindex.py b/test/functional/feature_coinstatsindex.py
index eac67a631e3b..ad6bb0a63ffc 100755
--- a/test/functional/feature_coinstatsindex.py
+++ b/test/functional/feature_coinstatsindex.py
@@ -54,6 +54,7 @@ def run_test(self):
         self._test_use_index_option()
         self._test_reorg_index()
         self._test_index_rejects_hash_serialized()
+        self._test_init_index_after_reorg()
 
     def block_subsidy(self, prev_bits):
         # Subsidy calculations valid till block 4500
@@ -75,6 +76,9 @@ def block_sanity_check(self, block_info, prev_height):
             block_info['new_outputs_ex_coinbase'] + block_info['coinbase'] + block_info['unspendable']
         )
 
+    def sync_index_node(self):
+        self.wait_until(lambda: self.nodes[1].getindexinfo()['coinstatsindex']['synced'] is True)
+
     def _test_coin_stats_index(self):
         node = self.nodes[0]
         index_node = self.nodes[1]
@@ -237,18 +241,16 @@ def _test_coin_stats_index(self):
         self.log.info("Test that the index works with -reindex")
 
         self.restart_node(1, extra_args=["-coinstatsindex", "-reindex"])
+        self.sync_index_node()
         res11 = index_node.gettxoutsetinfo('muhash')
         assert_equal(res11, res10)
 
-        self.log.info("Test that -reindex-chainstate is disallowed with coinstatsindex")
+        self.log.info("Test that the index works with -reindex-chainstate")
 
-        self.stop_node(1)
-        self.nodes[1].assert_start_raises_init_error(
-            expected_msg='Error: -reindex-chainstate option is not compatible with -coinstatsindex. '
-            'Please temporarily disable coinstatsindex while using -reindex-chainstate, or replace -reindex-chainstate with -reindex to fully rebuild all indexes.',
-            extra_args=['-coinstatsindex', '-reindex-chainstate'],
-        )
-        self.restart_node(1, extra_args=["-coinstatsindex"])
+        self.restart_node(1, extra_args=["-coinstatsindex", "-reindex-chainstate"])
+        self.sync_index_node()
+        res12 = index_node.gettxoutsetinfo('muhash')
+        assert_equal(res12, res10)
 
         self.log.info("Test obtaining info for a non-existent block hash")
         assert_raises_rpc_error(-5, "Block not found", index_node.gettxoutsetinfo, hash_type="none", hash_or_height="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", use_index=True)
@@ -270,6 +272,7 @@ def _test_reorg_index(self):
         index_node = self.nodes[1]
         reorg_blocks = self.generatetoaddress(index_node, 2, getnewdestination()[2])
         reorg_block = reorg_blocks[1]
+        self.sync_index_node()
         res_invalid = index_node.gettxoutsetinfo('muhash')
         index_node.invalidateblock(reorg_blocks[0])
         assert_equal(index_node.gettxoutsetinfo('muhash')['height'], 110)
@@ -309,6 +312,41 @@ def _test_index_rejects_hash_serialized(self):
         for use_index in {True, False, None}:
             assert_raises_rpc_error(-8, msg, self.nodes[1].gettxoutsetinfo, hash_type='hash_serialized_2', hash_or_height=111, use_index=use_index)
 
+    def _test_init_index_after_reorg(self):
+        self.log.info("Test a reorg while the index is deactivated")
+        index_node = self.nodes[1]
+        block = self.nodes[0].getbestblockhash()
+        self.generate(index_node, 2, sync_fun=self.no_op)
+        self.sync_index_node()
+
+        # Restart without index
+        self.restart_node(1, extra_args=[])
+        self.connect_nodes(0, 1)
+        index_node.invalidateblock(block)
+        self.generatetoaddress(index_node, 5, getnewdestination()[2])
+        res = index_node.gettxoutsetinfo(hash_type='muhash', hash_or_height=None, use_index=False)
+
+        # Restart with index that still has its best block on the old chain
+        self.restart_node(1, extra_args=self.extra_args[1])
+        self.sync_index_node()
+        res1 = index_node.gettxoutsetinfo(hash_type='muhash', hash_or_height=None, use_index=True)
+        assert_equal(res["muhash"], res1["muhash"])
+
+        self.log.info("Test index with an unclean restart after a reorg")
+        self.restart_node(1, extra_args=self.extra_args[1])
+        committed_height = index_node.getblockcount()
+        self.generate(index_node, 2, sync_fun=self.no_op)
+        self.sync_index_node()
+        block2 = index_node.getbestblockhash()
+        index_node.invalidateblock(block2)
+        self.generatetoaddress(index_node, 1, getnewdestination()[2], sync_fun=self.no_op)
+        self.sync_index_node()
+        index_node.kill_process()
+        self.start_node(1, extra_args=self.extra_args[1])
+        self.sync_index_node()
+        # Because of the unclean shutdown above, indexes reset to the point we last committed them to disk.
+        assert_equal(index_node.getindexinfo()['coinstatsindex']['best_block_height'], committed_height)
+
 
 if __name__ == '__main__':
     CoinStatsIndexTest().main()
diff --git a/test/functional/feature_config_args.py b/test/functional/feature_config_args.py
index e67af8282d38..d19b6ffd1a3d 100755
--- a/test/functional/feature_config_args.py
+++ b/test/functional/feature_config_args.py
@@ -335,6 +335,27 @@ def test_ignored_conf(self):
         self.start_node(0, [f'-conf={node.datadir}/dash.conf'])
         self.stop_node(0)
 
+    def test_missing_default_datadir(self):
+        # Overriding the default datadir through the environment does not work on Windows
+        if sys.platform == "win32":
+            return
+
+        self.log.info('Test -version, -help and a first start without a default data directory')
+        node = self.nodes[0]
+        node_args = node.args
+        node.args = [arg for arg in node.args if not arg.startswith("-datadir=")]
+        for name, extra_args in [("version", ["-version"]), ("help", ["-help"]), ("start", ["-regtest", "-listen=0", "-server=0"])]:
+            env, default_datadir = util.get_temp_default_datadir(pathlib.Path(self.options.tmpdir, "no_datadir", name))
+            default_datadir.parent.mkdir(parents=True)
+            node.start(extra_args, env=env)
+            if name == "start":
+                debug_log = default_datadir / "regtest" / "debug.log"
+                self.wait_until(lambda: node.process.poll() is not None or (debug_log.exists() and "Done loading" in debug_log.read_text(encoding="utf-8")))
+                assert node.process.poll() is None
+                node.process.terminate()
+            node.wait_until_stopped()
+        node.args = node_args
+
     def test_ignored_default_conf(self):
         # Disable this test for windows currently because trying to override
         # the default datadir through the environment does not seem to work.
@@ -379,6 +400,7 @@ def run_test(self):
         self.test_config_file_log()
         self.test_invalid_command_line_options()
         self.test_ignored_conf()
+        self.test_missing_default_datadir()
         self.test_ignored_default_conf()
 
         # Remove the -datadir argument so it doesn't override the config file
diff --git a/test/functional/feature_masternode_shares.py b/test/functional/feature_masternode_shares.py
index bf4bff228a51..b153581e3ffa 100755
--- a/test/functional/feature_masternode_shares.py
+++ b/test/functional/feature_masternode_shares.py
@@ -10,8 +10,21 @@
 from decimal import Decimal
 
 from test_framework.descriptors import descsum_create
-from test_framework.key import ORDER
-from test_framework.messages import COIN, CBlock, COutPoint, CTransaction, CTxIn, CTxOut, from_hex, tx_from_hex
+from test_framework.address import key_to_p2pkh
+from test_framework.crypto import secp256k1
+from test_framework.key import ECKey, ORDER, rfc6979_nonce
+from test_framework.messages import (
+    COIN,
+    CBlock,
+    COutPoint,
+    CTransaction,
+    CTxIn,
+    CTxOut,
+    from_hex,
+    hash256,
+    ser_string,
+    tx_from_hex,
+)
 from test_framework.script import CScript
 from test_framework.test_framework import DashTestFramework, p2p_port
 from test_framework.util import (
@@ -21,7 +34,7 @@
     get_bip9_details,
     softfork_active,
 )
-from test_framework.wallet_util import get_generate_key
+from test_framework.wallet_util import bytes_to_wif, get_generate_key
 
 # Keep the earliest activation height above the ~119 blocks the framework setup mines, so
 # run_test starts with v24 locked in but not yet active and can exercise pre-activation rules
@@ -37,11 +50,37 @@
 EARLY_PERIOD_BLOCKS = 30
 EARLY_PENALTY = 50 * COIN
 DISSOLVE_FEE = 100000
+MAX_DISSOLVE_FEE = 1000000
 TRANSACTION_PROVIDER_DISSOLVE = 10
 TRANSACTION_PROVIDER_UPDATE_SHARE = 11
 TRANSACTION_PROVIDER_UPDATE_SHARED_REGISTRAR = 12
 
 
+def sign_compact(key, digest):
+    """A recoverable compact signature by `key` over `digest`, as CHashSigner::SignHash produces"""
+    z = int.from_bytes(digest, "big")
+    k = int.from_bytes(rfc6979_nonce(key.get_bytes() + digest), "big")
+    R = k * secp256k1.G
+    r = int(R.x) % ORDER
+    s = pow(k, -1, ORDER) * (z + int.from_bytes(key.get_bytes(), "big") * r) % ORDER
+    recid = (0 if R.y.is_even() else 1) | (2 if int(R.x) >= ORDER else 0)
+    if s > ORDER // 2:
+        s = ORDER - s
+        recid ^= 1
+    return bytes([27 + 4 + recid]) + r.to_bytes(32, "big") + s.to_bytes(32, "big")
+
+
+def prodis_sign_hash(tx, sig_count):
+    """CProDisTx::MakeSignHash: the payload prefix is its 2-byte version, proTxHash and actorIndex"""
+    payload = tx.vExtraPayload
+    data = ser_string(b"DashSharedMNDissolve") + payload[:2]
+    data += struct.pack("<hHI", tx.nVersion, tx.nType, tx.nLockTime)
+    data += b"".join(txin.prevout.serialize() for txin in tx.vin)
+    data += b"".join(struct.pack("<I", txin.nSequence) for txin in tx.vin)
+    data += b"".join(out.serialize() for out in tx.vout)
+    return hash256(data + payload[2:36] + bytes([sig_count]))
+
+
 class MasternodeSharesTest(DashTestFramework):
     def add_options(self, parser):
         self.add_wallet_options(parser)
@@ -138,7 +177,7 @@ def assert_rejected_transaction(self, node, tx, reason, *, mempool_reason=None):
         assert_equal(node.getbestblockhash(), tip)
         assert_equal(set(node.getrawmempool()), mempool)
 
-    def test_invalid_dissolutions(self, node, miner, wallets, protx_hash, shares):
+    def test_invalid_dissolutions(self, node, miner, wallets, owner_keys, protx_hash, shares):
         self.log.info("Every actor's dissolution protects all refund destinations and principal amounts")
         state = miner.protx("info", protx_hash)["state"]
         penalty = 10 * COIN
@@ -168,7 +207,7 @@ def test_invalid_dissolutions(self, node, miner, wallets, protx_hash, shares):
                 self.assert_rejected_transaction(node, bad, "bad-prodis-payee")
 
             bad = deepcopy(good)
-            bad.vout[-1].nValue -= 1000000 - DISSOLVE_FEE + 1
+            bad.vout[-1].nValue -= MAX_DISSOLVE_FEE - DISSOLVE_FEE + 1
             self.assert_rejected_transaction(node, bad, "bad-prodis-fee")
             bad = deepcopy(good)
             bad.vout.pop()
@@ -194,14 +233,46 @@ def sign_unanimous(tx):
             sigs = [wallet.protx("shared_sign", raw)["signatures"][0] for wallet in wallets]
             return tx_from_hex(miner.protx("shared_combine", raw, sigs))
 
+        def sign_outside_wallet(tx):
+            signed = deepcopy(tx)
+            digest = prodis_sign_hash(signed, len(owner_keys))
+            signed.vExtraPayload = (signed.vExtraPayload[:36] + bytes([len(owner_keys)]) +
+                                    b"".join(sign_compact(key, digest) for key in owner_keys))
+            return signed
+
+        def assert_sign_refused(tx, signers=wallets):
+            for wallet in signers:
+                assert_raises_rpc_error(-8, "does not return every share's principal", wallet.protx,
+                                        "shared_sign", tx.serialize().hex())
+
         unsigned = tx_from_hex(prepared["tx"])
         unanimous = sign_unanimous(unsigned)
         assert_equal(node.testmempoolaccept([unanimous.serialize().hex()])[0]["allowed"], True)
+        assert_equal(sign_outside_wallet(unsigned).vExtraPayload, unanimous.vExtraPayload)
+
+        self.log.info("shared_sign signs only a dissolution that returns every share's principal")
+        for actor, fee in ((0, DISSOLVE_FEE), (7, MAX_DISSOLVE_FEE)):
+            edge = miner.protx("shared_dissolve_prepare", protx_hash, actor, fee)["tx"]
+            assert_equal(len(wallets[actor].protx("shared_sign", edge)["signatures"]), 1)
+        # Consensus accepts a redistribution every share owner signs, but no wallet signs one, neither
+        # the actor's that gives its principal away nor the one receiving it
+        redistribution = deepcopy(unsigned)
+        redistribution.vout[0].nValue += redistribution.vout[-1].nValue
+        redistribution.vout.pop()
+        assert_sign_refused(redistribution)
+        redistributed = sign_outside_wallet(redistribution)
+        assert_equal(node.testmempoolaccept([redistributed.serialize().hex()])[0]["allowed"], True)
+        # A zero fee, and a fee above the consensus ceiling
+        for fee_change in (DISSOLVE_FEE, DISSOLVE_FEE - MAX_DISSOLVE_FEE - 1):
+            bad = deepcopy(unsigned)
+            bad.vout[-1].nValue += fee_change
+            assert_sign_refused(bad, [wallets[0], wallets[7]])
         # These outputs satisfy both modes even during the early period. Dropping
         # signatures must fail authorization, rather than only the penalty checks.
         penalty_unsigned = tx_from_hex(wallets[7].protx("shared_dissolve", protx_hash, 7, DISSOLVE_FEE, False))
         penalty_unsigned.vExtraPayload = penalty_unsigned.vExtraPayload[:36] + b"\x00"
-        penalty_unanimous = sign_unanimous(penalty_unsigned)
+        assert_sign_refused(penalty_unsigned, [wallets[0], wallets[7]])
+        penalty_unanimous = sign_outside_wallet(penalty_unsigned)
         assert_equal(node.testmempoolaccept([penalty_unanimous.serialize().hex()])[0]["allowed"], True)
         bad = deepcopy(penalty_unanimous)
         bad.vExtraPayload = bad.vExtraPayload[:36] + b"\x01" + bad.vExtraPayload[-65:]
@@ -209,12 +280,14 @@ def sign_unanimous(tx):
         for index in range(len(shares)):
             bad = deepcopy(unsigned)
             bad.vout[index].scriptPubKey = attacker_script
-            self.assert_rejected_transaction(node, sign_unanimous(bad), "bad-prodis-payee")
+            assert_sign_refused(bad, [wallets[index]])
+            self.assert_rejected_transaction(node, sign_outside_wallet(bad), "bad-prodis-payee")
         for index in range(len(shares) - 1):
             bad = deepcopy(unsigned)
             bad.vout[index].nValue -= 1
             bad.vout[-1].nValue += 1
-            self.assert_rejected_transaction(node, sign_unanimous(bad), "bad-prodis-penalty-floor")
+            assert_sign_refused(bad, [wallets[index]])
+            self.assert_rejected_transaction(node, sign_outside_wallet(bad), "bad-prodis-penalty-floor")
 
         self.log.info("Dissolution shape, signer ordering, canonical signatures and signed fields are enforced")
         bad = deepcopy(unanimous)
@@ -384,7 +457,7 @@ def test_separate_participant_wallets(self):
         self.log.info("Eight separate wallets fund and authorize a shared masternode")
         node = self.nodes[0]
         miner = node.get_wallet_rpc(self.default_wallet_name)
-        wallets, shares, funding_addresses, change_addresses = [], [], [], []
+        wallets, owner_keys, shares, funding_addresses, change_addresses = [], [], [], [], []
         common_reward = miner.getnewaddress()
         for i, amount in enumerate([100] * 7 + [300]):
             name = f"participant_{i}"
@@ -403,8 +476,19 @@ def test_separate_participant_wallets(self):
                     for key in keys:
                         wallet.importprivkey(key.privkey)
                     refund = wallet.addmultisigaddress(2, [key.pubkey for key in keys])["address"]
+            # The test keeps the owner key too, to sign dissolutions the wallet refuses to
+            owner_key = ECKey()
+            owner_key.generate()
+            owner_wif = bytes_to_wif(owner_key.get_bytes())
+            if self.options.descriptors:
+                result, = wallet.importdescriptors([{"desc": descsum_create(f"pkh({owner_wif})"), "timestamp": "now"}])
+                assert_equal(result["success"], True)
+            else:
+                wallet.importprivkey(owner_wif, "", False)
+            owner_keys.append(owner_key)
             shares.append({"amount": amount * COIN, "refundAddress": refund,
-                           "ownerAddress": wallet.getnewaddress(), "rewardAddress": common_reward})
+                           "ownerAddress": key_to_p2pkh(owner_key.get_pubkey().get_bytes().hex()),
+                           "rewardAddress": common_reward})
             funding_addresses.append(wallet.getnewaddress())
             change_addresses.append(wallet.getnewaddress())
 
@@ -585,7 +669,7 @@ def script_of(wallet):
         self.generate(node, 1, sync_fun=self.no_op)
         assert_equal(miner.protx("info", protx_hash)["state"]["votingAddress"], voting)
 
-        self.test_invalid_dissolutions(node, miner, wallets, protx_hash, shares)
+        self.test_invalid_dissolutions(node, miner, wallets, owner_keys, protx_hash, shares)
 
         self.log.info("A pre-signed unanimous dissolution survives reindex and pays spendable refunds")
         prepared_dissolve = miner.protx("shared_dissolve_prepare", protx_hash, 7, DISSOLVE_FEE)
diff --git a/test/functional/feature_pruning.py b/test/functional/feature_pruning.py
index ff9a7af4e14d..bda05593c69c 100755
--- a/test/functional/feature_pruning.py
+++ b/test/functional/feature_pruning.py
@@ -152,7 +152,7 @@ def test_invalid_command_line_options(self):
         )
 
     def test_rescan_blockchain(self):
-        self.restart_node(0, ["-prune=550"] + DEPLOYMENT_ARGS)
+        self.restart_node(0, ["-prune=550"] + DEPLOYMENT_ARGS, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
         assert_raises_rpc_error(-1, "Can't rescan beyond pruned data. Use RPC call getblockchaininfo to determine your pruned height.", self.nodes[0].rescanblockchain)
 
     def test_height_min(self):
@@ -487,6 +487,15 @@ def run_test(self):
         self.log.info("Test manual pruning with timestamps")
         self.manual_test(4, use_timestamp=True)
 
+        self.log.info("Syncing node 5 to node 0")
+        self.connect_nodes(0, 5)
+        self.sync_blocks([self.nodes[0], self.nodes[5]], wait=5, timeout=300)
+
+        self.log.info("Test prune with a new index")
+        self.restart_node(0, extra_args=["-txindex=0", "-prune=550", "-blockfilterindex=1"] + DEPLOYMENT_ARGS)
+        node = self.nodes[0]
+        self.wait_until(lambda: node.getindexinfo()["basic block filter index"]["best_block_height"] >= 10, timeout=300)
+
         if self.is_wallet_compiled():
             self.log.info("Test wallet re-scan")
             self.wallet_test()
diff --git a/test/functional/p2p_blockfilters.py b/test/functional/p2p_blockfilters.py
index 6d3902f62a74..b28bd45e635d 100755
--- a/test/functional/p2p_blockfilters.py
+++ b/test/functional/p2p_blockfilters.py
@@ -293,13 +293,6 @@ def run_test(self):
         msg = "Error: Unknown -blockfilterindex value abc."
         self.nodes[0].assert_start_raises_init_error(expected_msg=msg)
 
-        self.log.info("Test -blockfilterindex with -reindex-chainstate raises an error")
-        self.nodes[0].assert_start_raises_init_error(
-            expected_msg='Error: -reindex-chainstate option is not compatible with -blockfilterindex. '
-            'Please temporarily disable blockfilterindex while using -reindex-chainstate, or replace -reindex-chainstate with -reindex to fully rebuild all indexes.',
-            extra_args=['-blockfilterindex', '-reindex-chainstate'],
-        )
-
         self.test_special_transactions_in_filters()
 
     def create_simple_assetlock(self, base_tx, base_tx_value, amount_locked_1, amount_locked_2=0):
diff --git a/test/functional/rpc_netinfo.py b/test/functional/rpc_netinfo.py
index 37cbb188318f..d6f84336beb0 100755
--- a/test/functional/rpc_netinfo.py
+++ b/test/functional/rpc_netinfo.py
@@ -6,6 +6,7 @@
 
 from test_framework.util import (
     assert_equal,
+    assert_raises_rpc_error,
     softfork_active
 )
 from test_framework.script import (
@@ -24,6 +25,8 @@
 
 # Height at which BIP9 deployment DEPLOYMENT_V24 is activated
 V24_ACTIVATION_THRESHOLD = 100
+# Height from which masternodes may operate without IPv4, see DEPLOYMENT_IPV4_OPTIONAL in src/consensus/params.h
+IPV4_OPTIONAL_HEIGHT = 500
 # See CMainParams in src/chainparams.cpp
 DEFAULT_PORT_MAINNET_CORE_P2P = 9999
 # See CRegTestParams in src/chainparams.cpp
@@ -160,7 +163,8 @@ def add_options(self, parser):
     def set_test_params(self):
         self.num_nodes = 3
         self.extra_args = [[
-            "-dip3params=2:2", f"-vbparams=v24:{self.mocktime}:999999999999:{V24_ACTIVATION_THRESHOLD}:10:8:6:5:0"
+            "-dip3params=2:2", f"-vbparams=v24:{self.mocktime}:999999999999:{V24_ACTIVATION_THRESHOLD}:10:8:6:5:0",
+            f"-testactivationheight=ipv4_optional@{IPV4_OPTIONAL_HEIGHT}"
         ] for _ in range(self.num_nodes)]
         self.extra_args[2] += ["-deprecatedrpc=service"]
 
@@ -210,6 +214,8 @@ def run_test(self):
         self.test_deprecation()
         self.log.info("Mine blocks to activate DEPLOYMENT_V24")
         self.activate_v24()
+        self.log.info("Test that primary addresses must be IPv4 until DEPLOYMENT_IPV4_OPTIONAL")
+        self.test_ipv4_optional()
         self.log.info("Test input validation for masternode address fields (post-fork)")
         self.test_validation_common()
         self.test_validation_extended()
@@ -405,6 +411,48 @@ def test_validation_extended(self):
         self.node_evo.register_mn(self, False, "127.0.0.1", DEFAULT_PORT_PLATFORM_P2P, DEFAULT_PORT_PLATFORM_HTTP,
                                   -8, "Error setting coreP2PAddrs[0] to '127.0.0.1' (invalid port)")
 
+    def test_ipv4_optional(self):
+        port_evo, port_two = self.node_evo.mn.nodePort, self.node_two.mn.nodePort
+        p2p, https = DEFAULT_PORT_PLATFORM_P2P, DEFAULT_PORT_PLATFORM_HTTP
+        # The first entry of each purpose must be IPv4, and Platform's must use the first Core P2P address
+        cases = [
+            ([f"[::1]:{port_evo}", f"127.0.0.1:{port_evo}"], [f"127.0.0.1:{p2p}"], [f"127.0.0.1:{https}"],
+             "bad-protx-netinfo-addr-type, first core_p2p entry must be IPv4"),
+            ([f"127.0.0.1:{port_evo}"], [f"127.0.0.2:{p2p}"], [f"127.0.0.1:{https}"],
+             "bad-protx-netinfo-addr, first platform_p2p entry must use the first core_p2p address"),
+            ([f"127.0.0.1:{port_evo}"], [f"127.0.0.1:{p2p}"], [f"{DOMAINS_CLR[0]}:{https}", f"127.0.0.1:{https}"],
+             "bad-protx-netinfo-addr-type, first platform_https entry must be IPv4"),
+        ]
+        update = ([f"127.0.0.1:{port_two}"], [f"{DOMAINS_TOR[0]}:{p2p}", f"127.0.0.1:{p2p}"], [f"127.0.0.2:{https}"],
+                  "bad-protx-netinfo-addr-type, first platform_p2p entry must be IPv4")
+
+        # The block after the tip is the one these would be included in
+        assert self.nodes[0].getblockcount() < IPV4_OPTIONAL_HEIGHT - 2
+        self.generate(self.nodes[0], IPV4_OPTIONAL_HEIGHT - 2 - self.nodes[0].getblockcount())
+        for core, plat_p2p, plat_https, error in cases:
+            self.node_evo.register_mn(self, False, core, plat_p2p, plat_https, -1, error)
+        self.node_two.update_mn(self, False, *update[:3], -1, update[3])
+
+        self.generate(self.nodes[0], 1)
+        txs = [self.node_evo.register_mn(self, False, *case[:3]) for case in cases]
+        txs.append(self.node_two.update_mn(self, False, *update[:3]))
+        for tx in txs:
+            assert self.nodes[0].testmempoolaccept([tx])[0]['allowed']
+
+        # Validation outside the RPCs, for the mempool and for blocks, applies the same rule at the same height
+        tip = self.nodes[0].getbestblockhash()
+        self.nodes[0].invalidateblock(tip)
+        address = self.nodes[0].getnewaddress()
+        for tx, (*_, error) in zip(txs, cases + [update]):
+            reason = error.split(",")[0]
+            result = self.nodes[0].testmempoolaccept([tx])[0]
+            assert_equal(result['allowed'], False)
+            assert_equal(result['reject-reason'], reason)
+            assert_raises_rpc_error(-25, f"TestBlockValidity failed: {reason}", self.nodes[0].generateblock, address,
+                                    [tx], invalid_call=False)
+        self.nodes[0].reconsiderblock(tip)
+        self.sync_blocks()
+
     def test_deprecation(self):
         # netInfo is represented with JSON in CProRegTx, CProUpServTx, CDeterministicMNState and CSimplifiedMNListEntry,
         # so we need to test calls that rely on these underlying implementations. Start by collecting RPC responses.
diff --git a/test/functional/test_framework/test_node.py b/test/functional/test_framework/test_node.py
index f44b0a772d56..329abe68c484 100755
--- a/test/functional/test_framework/test_node.py
+++ b/test/functional/test_framework/test_node.py
@@ -311,7 +311,7 @@ def wait_for_rpc_connection(self):
                 if self.version_is_at_least(180000):
                     # getmempoolinfo.loaded is available since commit
                     # 71e38b9ebcb78b3a264a4c25c7c4e373317f2a40 (version 0.18.0)
-                    wait_until_helper(lambda: rpc.getmempoolinfo()['loaded'])
+                    wait_until_helper(lambda: rpc.getmempoolinfo()['loaded'], timeout_factor=self.timeout_factor)
                     # Wait for the node to finish reindex, block import, and
                     # loading the mempool. Usually importing happens fast or
                     # even "immediate" when the node is started. However, there
@@ -458,9 +458,15 @@ def is_node_stopped(self, expected_ret_code=None):
         self.log.debug("Node stopped")
         return True
 
-    def wait_until_stopped(self, timeout=BITCOIND_PROC_WAIT_TIMEOUT, expect_error=False):
-        expected_ret_code = 1 if expect_error else None  # Whether node shutdown return EXIT_FAILURE or EXIT_SUCCESS
-        wait_until_helper(lambda: self.is_node_stopped(expected_ret_code=expected_ret_code), timeout=timeout, timeout_factor=self.timeout_factor)
+    def wait_until_stopped(self, *, timeout=BITCOIND_PROC_WAIT_TIMEOUT, expect_error=False, **kwargs):
+        if "expected_ret_code" not in kwargs:
+            kwargs["expected_ret_code"] = 1 if expect_error else None  # Whether node shutdown return EXIT_FAILURE or EXIT_SUCCESS
+        wait_until_helper(lambda: self.is_node_stopped(**kwargs), timeout=timeout, timeout_factor=self.timeout_factor)
+
+    def kill_process(self):
+        self.process.kill()
+        self.wait_until_stopped(expected_ret_code=1 if platform.system() == "Windows" else -9)
+        assert self.is_node_stopped()
 
     def replace_in_config(self, replacements):
         """
diff --git a/test/functional/tool_wallet.py b/test/functional/tool_wallet.py
index 38a48fc9f657..f7928b46644e 100755
--- a/test/functional/tool_wallet.py
+++ b/test/functional/tool_wallet.py
@@ -401,7 +401,91 @@ def test_dump_createfromdump(self):
         self.write_dump(dump_data, bad_sum_wallet_dump)
         self.assert_raises_tool_error('Error: Checksum is not the correct size', '-wallet=badload', '-dumpfile={}'.format(bad_sum_wallet_dump), 'createfromdump')
         assert not os.path.isdir(os.path.join(self.nodes[0].datadir, "regtest/wallets", "badload"))
+        if not self.options.descriptors:
+            os.rename(self.nodes[0].chain_path / "wallets" / "wallet.dat", self.nodes[0].chain_path / "wallets" / "../default.wallet.dat")
+            (self.nodes[0].chain_path / "wallets" / "db.log").unlink(missing_ok=True)
+        self.assert_raises_tool_error('Error: Checksum is not the correct size', '-wallet=', '-dumpfile={}'.format(bad_sum_wallet_dump), 'createfromdump')
+        assert (self.nodes[0].chain_path / "wallets").exists()
+        assert not (self.nodes[0].chain_path / "wallets" / "wallet.dat").exists()
+        if not self.options.descriptors:
+            assert not (self.nodes[0].chain_path / "wallets" / "db.log").exists()
+
+        self.log.info('Checking createfromdump with an unnamed wallet')
+        self.do_tool_createfromdump("", "wallet.dump")
+        assert (self.nodes[0].chain_path / "wallets" / "wallet.dat").exists()
+        os.unlink(self.nodes[0].chain_path / "wallets" / "wallet.dat")
+        if not self.options.descriptors:
+            os.rename(self.nodes[0].chain_path / "wallets" / "../default.wallet.dat", self.nodes[0].chain_path / "wallets" / "wallet.dat")
+
+            self.log.info('Checking createfromdump with multiple non-directory wallets')
+            assert not (self.nodes[0].chain_path / "wallets" / "wallet.dat").is_dir()
+            assert (self.nodes[0].chain_path / "wallets" / "db.log").exists()
+            os.rename(self.nodes[0].chain_path / "wallets" / "wallet.dat", self.nodes[0].chain_path / "wallets" / "test.dat")
+            self.assert_raises_tool_error('Error: Checksum is not the correct size', '-wallet=', '-dumpfile={}'.format(bad_sum_wallet_dump), 'createfromdump')
+            assert not (self.nodes[0].chain_path / "wallets" / "wallet.dat").exists()
+            assert (self.nodes[0].chain_path / "wallets" / "test.dat").exists()
+            assert (self.nodes[0].chain_path / "wallets" / "db.log").exists()
+            os.rename(self.nodes[0].chain_path / "wallets" / "test.dat", self.nodes[0].chain_path / "wallets" / "wallet.dat")
+
+    def test_chainless_conflicts(self):
+        self.log.info("Test wallet tool when wallet contains conflicting transactions")
+        self.restart_node(0)
+        self.generate(self.nodes[0], 101)
+
+        def_wallet = self.nodes[0].get_wallet_rpc(self.default_wallet_name)
+
+        self.nodes[0].createwallet("conflicts")
+        wallet = self.nodes[0].get_wallet_rpc("conflicts")
+        def_wallet.sendtoaddress(wallet.getnewaddress(), 10)
+        self.generate(self.nodes[0], 1)
+
+        # parent tx
+        parent_txid = wallet.sendtoaddress(wallet.getnewaddress(), 9)
+        parent_txid_bytes = bytes.fromhex(parent_txid)[::-1]
+        conflict_utxo = wallet.gettransaction(txid=parent_txid, verbose=True)["decoded"]["vin"][0]
+
+        # The specific assertion in MarkConflicted being tested requires that the parent tx is already loaded
+        # by the time the child tx is loaded. Since transactions end up being loaded in txid order due to how both
+        # and sqlite store things, we can just grind the child tx until it has a txid that is greater than the parent's.
+        locktime = 500000000 # Use locktime as nonce, starting at unix timestamp minimum
+        addr = wallet.getnewaddress()
+        while True:
+            child_send_res = wallet.send(outputs=[{addr: 8}], options={"add_to_wallet": False, "locktime": locktime})
+            child_txid = child_send_res["txid"]
+            child_txid_bytes = bytes.fromhex(child_txid)[::-1]
+            if (child_txid_bytes > parent_txid_bytes):
+                wallet.sendrawtransaction(child_send_res["hex"])
+                break
+            locktime += 1
+
+        # conflict with parent
+        conflict_unsigned = self.nodes[0].createrawtransaction(inputs=[conflict_utxo], outputs=[{wallet.getnewaddress(): 9.9999}])
+        conflict_signed = wallet.signrawtransactionwithwallet(conflict_unsigned)["hex"]
+        conflict_txid = self.nodes[0].decoderawtransaction(conflict_signed)["txid"]
+        # Dash has no RBF, so the conflicting tx cannot be broadcast while the parent is in
+        # the mempool. Mine it directly into a block instead, which conflicts the parent and
+        # the child just the same.
+        self.generateblock(self.nodes[0], output=def_wallet.getnewaddress(), transactions=[conflict_signed])
+        assert_equal(wallet.gettransaction(txid=parent_txid)["confirmations"], -1)
+        assert_equal(wallet.gettransaction(txid=child_txid)["confirmations"], -1)
+        assert_equal(wallet.gettransaction(txid=conflict_txid)["confirmations"], 1)
+
+        self.stop_node(0)
 
+        # Wallet tool should successfully give info for this wallet
+        expected_output = textwrap.dedent(f'''\
+            Wallet info
+            ===========
+            Name: conflicts
+            Format: {"sqlite" if self.options.descriptors else "bdb"}
+            Descriptors: {"yes" if self.options.descriptors else "no"}
+            Encrypted: no
+            HD (hd seed available): yes
+            Keypool Size: {"2" if self.options.descriptors else "1"}
+            Transactions: 4
+            Address Book: 4
+        ''')
+        self.assert_tool_output(expected_output, "-wallet=conflicts", "info")
 
     def test_nonhd(self):
         self.log.info('Check non-hd wallet')
@@ -427,6 +511,7 @@ def run_test(self):
             self.test_wipe()
             self.test_nonhd()
         self.test_dump_createfromdump()
+        self.test_chainless_conflicts()
 
 if __name__ == '__main__':
     ToolWalletTest().main()
diff --git a/test/functional/wallet_backup.py b/test/functional/wallet_backup.py
index ba7007bee964..1dda425b8f69 100755
--- a/test/functional/wallet_backup.py
+++ b/test/functional/wallet_backup.py
@@ -37,7 +37,11 @@
 
 from test_framework.blocktools import COINBASE_MATURITY
 from test_framework.test_framework import BitcoinTestFramework
-from test_framework.util import assert_equal, assert_raises_rpc_error
+from test_framework.util import (
+    assert_equal,
+    assert_raises_rpc_error,
+    sha256sum_file,
+)
 
 class WalletBackupTest(BitcoinTestFramework):
     def add_options(self, parser):
@@ -155,18 +159,85 @@ def restore_preserves_existing_directory(self):
             with open(sentinel, encoding='utf8') as f:
                 assert_equal(f.read(), 'preserve existing data')
             assert_raises_rpc_error(-8, 'Backup file does not exist', node.restorewallet, wallet_name, backup_file + '.missing')
-            assert_raises_rpc_error(-36, 'Database already exists', node.restorewallet, wallet_name, backup_file)
+            existing_db = os.path.join(destination, 'wallet.dat')
+            with open(existing_db, 'w', encoding='utf8') as f:
+                f.write('not a wallet')
+            assert_raises_rpc_error(-36, 'Database file exists', node.restorewallet, wallet_name, backup_file)
             assert os.path.isfile(sentinel)
+            with open(existing_db, encoding='utf8') as f:
+                assert_equal(f.read(), 'not a wallet')
 
     def restore_wallet_existent_name(self):
         node = self.nodes[3]
         backup_file = os.path.join(self.nodes[0].datadir, 'wallet.bak')
         wallet_name = "res0"
         wallet_file = os.path.join(node.datadir, self.chain, 'wallets', wallet_name)
-        error_message = "Failed to create database path '{}'. Database already exists.".format(wallet_file)
+        error_message = "Failed to restore wallet. Database file exists in '{}'.".format(os.path.join(wallet_file, "wallet.dat"))
         assert_raises_rpc_error(-36, error_message, node.restorewallet, wallet_name, backup_file)
         assert os.path.exists(wallet_file)
 
+    def test_restore_existent_dir(self):
+        self.log.info("Test restore on an existent empty directory")
+        node = self.nodes[3]
+        backup_file = os.path.join(self.nodes[0].datadir, 'wallet.bak')
+        wallet_name = "restored_wallet"
+        wallet_dir = node.chain_path / "wallets" / wallet_name
+        os.mkdir(wallet_dir)
+        res = node.restorewallet(wallet_name, backup_file)
+        assert_equal(res['name'], wallet_name)
+        node.unloadwallet(wallet_name)
+
+        self.log.info("Test restore succeeds when the target directory contains non-wallet files")
+        wallet_file = node.chain_path / "wallets" / wallet_name / "wallet.dat"
+        os.remove(wallet_file)
+        extra_file = node.chain_path / "wallets" / wallet_name / "not_a_wallet.txt"
+        extra_file.touch()
+        res = node.restorewallet(wallet_name, backup_file)
+        assert_equal(res['name'], wallet_name)
+        assert extra_file.exists() # extra file was not removed by mistake
+        node.unloadwallet(wallet_name)
+
+        self.log.info("Test restore failure due to existing db file in the destination directory")
+        original_shasum = sha256sum_file(wallet_file)
+        error_message = "Failed to restore wallet. Database file exists in '{}'.".format(wallet_dir / "wallet.dat")
+        assert_raises_rpc_error(-36, error_message, node.restorewallet, wallet_name, backup_file)
+        # Ensure the wallet file remains untouched
+        assert wallet_dir.exists()
+        assert_equal(original_shasum, sha256sum_file(wallet_file))
+
+        self.log.info("Test restore succeeds when the .dat file in the destination has a different name")
+        second_wallet = wallet_dir / "hidden_storage.dat"
+        os.rename(wallet_dir / "wallet.dat", second_wallet)
+        original_shasum = sha256sum_file(second_wallet)
+        res = node.restorewallet(wallet_name, backup_file)
+        assert_equal(res['name'], wallet_name)
+        assert (wallet_dir / "hidden_storage.dat").exists()
+        assert_equal(original_shasum, sha256sum_file(second_wallet))
+        node.unloadwallet(wallet_name)
+
+        # Clean for follow-up tests
+        os.remove(wallet_file)
+
+    def test_restore_into_unnamed_wallet(self):
+        self.log.info("Test restore into a default unnamed wallet")
+        # This is also useful to test the migration recovery after failure logic
+        node = self.nodes[3]
+        if not self.options.descriptors:
+            node.unloadwallet("")
+            os.rename(node.chain_path / "wallets" / "wallet.dat", node.chain_path / "wallets" / "default.wallet.dat")
+        backup_file = os.path.join(self.nodes[0].datadir, 'wallet.bak')
+        wallet_name = ""
+        res = node.restorewallet(wallet_name, backup_file)
+        assert_equal(res['name'], "")
+        assert (node.chain_path / "wallets" / "wallet.dat").exists()
+        # Clean for follow-up tests
+        node.unloadwallet("")
+        os.remove(node.chain_path / "wallets" / "wallet.dat")
+        if not self.options.descriptors:
+            os.rename(node.chain_path / "wallets" / "default.wallet.dat", node.chain_path / "wallets" / "wallet.dat")
+            node.loadwallet("")
+
+
     def run_test(self):
         self.log.info("Generating initial blockchain")
         self.generate(self.nodes[0], 1)
@@ -243,6 +314,8 @@ def run_test(self):
         assert_equal(res2_rpc.getbalance(), balance2)
 
         self.restore_wallet_existent_name()
+        self.test_restore_existent_dir()
+        self.test_restore_into_unnamed_wallet()
 
         if not self.options.descriptors:
             self.log.info("Restoring using dumped wallet")
@@ -254,6 +327,7 @@ def run_test(self):
             shutil.rmtree(os.path.join(self.nodes[2].datadir, self.chain, 'chainstate'))
             shutil.rmtree(os.path.join(self.nodes[2].datadir, self.chain, 'evodb'))
             shutil.rmtree(os.path.join(self.nodes[2].datadir, self.chain, 'llmq'))
+            shutil.rmtree(os.path.join(self.nodes[2].datadir, self.chain, 'indexes'))
 
             self.start_three(["-nowallet"])
             # Create new wallets for the three nodes.
diff --git a/test/functional/wallet_hd.py b/test/functional/wallet_hd.py
index 87da58189f93..c7103ef65f3f 100755
--- a/test/functional/wallet_hd.py
+++ b/test/functional/wallet_hd.py
@@ -90,6 +90,7 @@ def run_test(self):
         shutil.rmtree(os.path.join(self.nodes[1].datadir, self.chain, "chainstate"))
         shutil.rmtree(os.path.join(self.nodes[1].datadir, self.chain, "evodb"))
         shutil.rmtree(os.path.join(self.nodes[1].datadir, self.chain, "llmq"))
+        shutil.rmtree(os.path.join(self.nodes[1].datadir, self.chain, "indexes"))
         shutil.copyfile(
             os.path.join(self.nodes[1].datadir, "hd.bak"),
             os.path.join(self.nodes[1].datadir, self.chain, "wallets", self.default_wallet_name, self.wallet_data_filename),
@@ -117,6 +118,7 @@ def run_test(self):
         shutil.rmtree(os.path.join(self.nodes[1].datadir, self.chain, "chainstate"))
         shutil.rmtree(os.path.join(self.nodes[1].datadir, self.chain, "evodb"))
         shutil.rmtree(os.path.join(self.nodes[1].datadir, self.chain, "llmq"))
+        shutil.rmtree(os.path.join(self.nodes[1].datadir, self.chain, "indexes"))
         shutil.copyfile(
             os.path.join(self.nodes[1].datadir, "hd.bak"),
             os.path.join(self.nodes[1].datadir, self.chain, "wallets", self.default_wallet_name, self.wallet_data_filename),
diff --git a/test/functional/wallet_migration.py b/test/functional/wallet_migration.py
index f1716b0aa103..af3bea63bdfb 100755
--- a/test/functional/wallet_migration.py
+++ b/test/functional/wallet_migration.py
@@ -4,19 +4,29 @@
 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
 """Test Migrating a wallet from legacy to descriptor."""
 
+from pathlib import Path
 import os
 import random
 import shutil
+import struct
+
 from test_framework.address import key_to_p2pkh, script_to_p2sh
+from test_framework.bdb import BTREE_MAGIC
 from test_framework.descriptors import descsum_create
+from test_framework.governance import EXPECTED_STDERR_NO_GOV_PRUNE
 from test_framework.key import ECPubKey
 from test_framework.test_framework import BitcoinTestFramework
 from test_framework.messages import COIN, CTransaction, CTxOut
 from test_framework.script_util import key_to_p2pkh_script, script_to_p2sh_script
 from test_framework.util import (
     assert_equal,
+    assert_greater_than,
     assert_raises_rpc_error,
     find_vout_for_address,
+    sha256sum_file,
+)
+from test_framework.wallet_util import (
+    get_generate_key,
 )
 
 
@@ -42,8 +52,8 @@ def assert_is_sqlite(self, wallet_name):
             assert_equal(file_magic, b'SQLite format 3\x00')
         assert_equal(self.nodes[0].get_wallet_rpc(wallet_name).getwalletinfo()["format"], "sqlite")
 
-    def create_legacy_wallet(self, wallet_name, disable_private_keys=False, blank=False):
-        self.nodes[0].createwallet(wallet_name=wallet_name, descriptors=False, disable_private_keys=disable_private_keys, blank=blank)
+    def create_legacy_wallet(self, wallet_name, disable_private_keys=False, blank=False, **kwargs):
+        self.nodes[0].createwallet(wallet_name=wallet_name, descriptors=False, disable_private_keys=disable_private_keys, blank=blank, **kwargs)
         wallet = self.nodes[0].get_wallet_rpc(wallet_name)
         info = wallet.getwalletinfo()
         assert_equal(info["descriptors"], False)
@@ -81,6 +91,15 @@ def assert_list_txs_equal(self, received_list_txs, expected_list_txs):
                 del d["parent_descs"]
         assert_equal(received_list_txs, expected_list_txs)
 
+    def check_address(self, wallet, addr, is_mine, is_change, label):
+        addr_info = wallet.getaddressinfo(addr)
+        assert_equal(addr_info['ismine'], is_mine)
+        assert_equal(addr_info['ischange'], is_change)
+        if label is not None:
+            assert_equal(addr_info['labels'], [label]),
+        else:
+            assert_equal(addr_info['labels'], []),
+
     def test_basic(self):
         default = self.nodes[0].get_wallet_rpc(self.default_wallet_name)
 
@@ -341,12 +360,17 @@ def test_other_watchonly(self):
         watchonly_spendable_txid = default.send(outputs=[{received_addr: 1}, {import_addr:1}])["txid"]
 
         self.generate(self.nodes[0], 2)
+        received_watchonly_tx_info = imports0.gettransaction(received_watchonly_txid, True)
+        received_sent_watchonly_tx_info = imports0.gettransaction(received_sent_watchonly_txid, True)
 
         balances = imports0.getbalances()
         spendable_bal = balances["mine"]["trusted"]
         watchonly_bal = balances["watchonly"]["trusted"]
         assert_equal(len(imports0.listtransactions(include_watchonly=True)), 6)
 
+        # Mock time forward a bit so we can check that tx metadata is preserved
+        self.bump_mocktime(100)
+
         # Migrate
         self.migrate_wallet(imports0)
         assert_equal(imports0.getwalletinfo()["descriptors"], True)
@@ -365,8 +389,12 @@ def test_other_watchonly(self):
         assert_equal(watchonly_info["descriptors"], True)
         self.assert_is_sqlite("imports0_watchonly")
         assert_equal(watchonly_info["private_keys_enabled"], False)
-        watchonly.gettransaction(received_watchonly_txid)
-        watchonly.gettransaction(received_sent_watchonly_txid)
+        received_migrated_watchonly_tx_info = watchonly.gettransaction(received_watchonly_txid)
+        assert_equal(received_watchonly_tx_info["time"], received_migrated_watchonly_tx_info["time"])
+        assert_equal(received_watchonly_tx_info["timereceived"], received_migrated_watchonly_tx_info["timereceived"])
+        received_sent_migrated_watchonly_tx_info = watchonly.gettransaction(received_sent_watchonly_txid)
+        assert_equal(received_sent_watchonly_tx_info["time"], received_sent_migrated_watchonly_tx_info["time"])
+        assert_equal(received_sent_watchonly_tx_info["timereceived"], received_sent_migrated_watchonly_tx_info["timereceived"])
         watchonly.gettransaction(sent_watchonly_txid)
         watchonly.gettransaction(watchonly_spendable_txid)
         assert_equal(watchonly.getbalance(), watchonly_bal)
@@ -548,19 +576,124 @@ def test_wallet_name_with_slashes(self):
         # Basename must use the sanitized prefix derived from the wallet
         # name's last component, not the full "nested/..." path.
         backup_basename = os.path.basename(backup_path)
-        assert backup_basename.startswith("subdir_wallet-"), backup_basename
+        assert backup_basename.startswith("subdir_wallet_"), backup_basename
         assert backup_basename.endswith(".legacy.bak"), backup_basename
 
         self.assert_is_sqlite(nested_name)
 
+    def clear_default_wallet(self, backup_file):
+        # Test cleanup: Clear unnamed default wallet for subsequent tests
+        (self.nodes[0].chain_path / "wallets" / "wallet.dat").unlink()
+        shutil.rmtree(self.nodes[0].chain_path / "wallets" / "default_wallet_watchonly", ignore_errors=True)
+        shutil.rmtree(self.nodes[0].chain_path / "wallets" / "default_wallet_solvables", ignore_errors=True)
+        backup_file.unlink()
+
     def test_default_wallet(self):
         self.log.info("Test migration of the wallet named as the empty string")
         wallet = self.create_legacy_wallet("")
 
-        self.migrate_wallet(wallet)
+        res = self.migrate_wallet(wallet)
+        info = wallet.getwalletinfo()
+        assert_equal(info["descriptors"], True)
+        assert_equal(info["format"], "sqlite")
+
+        wallet.unloadwallet()
+        self.clear_default_wallet(backup_file=Path(res["backup_path"]))
+
+    def test_default_wallet_watch_only(self):
+        self.log.info("Test unnamed (default) watch-only wallet migration")
+        def_wallet = self.nodes[0].get_wallet_rpc(self.default_wallet_name)
+        wallet = self.create_legacy_wallet("")
+        wallet.importaddress(def_wallet.getnewaddress())
+
+        res = self.migrate_wallet(wallet)
+        wallet = self.nodes[0].get_wallet_rpc("")
+        watchonly_wallet = self.nodes[0].get_wallet_rpc("default_wallet_watchonly")
+
+        info = watchonly_wallet.getwalletinfo()
+        assert_equal(info["descriptors"], True)
+        assert_equal(info["format"], "sqlite")
+        assert_equal(info["private_keys_enabled"], False)
+        assert_equal(info["walletname"], "default_wallet_watchonly")
+
+        # The default wallet will still exist and have newly generated descriptors
+        assert (self.nodes[0].chain_path / "wallets" / "wallet.dat").exists()
         info = wallet.getwalletinfo()
         assert_equal(info["descriptors"], True)
         assert_equal(info["format"], "sqlite")
+        assert_equal(info["private_keys_enabled"], True)
+        assert_equal(info["walletname"], "")
+        assert_greater_than(info["keypoolsize"], 0)
+
+        wallet.unloadwallet()
+        watchonly_wallet.unloadwallet()
+        self.clear_default_wallet(backup_file=Path(res["backup_path"]))
+
+    def test_migration_failure(self, wallet_name):
+        is_default = wallet_name == ""
+        wallet_pretty_name = "unnamed (default)" if is_default else f'"{wallet_name}"'
+        self.log.info(f"Test failure during migration of wallet named: {wallet_pretty_name}")
+        # Preface, set up legacy wallet and unload it
+        master_wallet = self.nodes[0].get_wallet_rpc(self.default_wallet_name)
+        wallet = self.create_legacy_wallet(wallet_name, blank=True)
+        wallet.importaddress(master_wallet.getnewaddress())
+        wallet.unloadwallet()
+
+        if os.path.isabs(wallet_name):
+            wallet_path = Path(wallet_name)
+        else:
+            wallet_path = self.nodes[0].chain_path / "wallets" / wallet_name
+
+        # This will be the watch-only directory the migration tries to create,
+        # we make migration fail by placing a wallet.dat file there.
+        wo_prefix = wallet_name or "default_wallet"
+        # wo_prefix might have path characters in it, this corresponds with
+        # DoMigration().
+        wo_dirname = f"{wo_prefix}_watchonly"
+        watch_only_dir = self.nodes[0].chain_path / "wallets" / wo_dirname
+        os.mkdir(watch_only_dir)
+        shutil.copyfile(wallet_path / "wallet.dat", watch_only_dir / "wallet.dat")
+
+        # Make a file in the wallets dir that must still exist after migration
+        survive_path = self.nodes[0].chain_path / "wallets" / "survive"
+        open(survive_path, "wb").close()
+        assert survive_path.exists()
+
+        # The backup is named after the node's time, which is the framework's mocktime
+        mocked_time = self.mocktime
+        assert_raises_rpc_error(-4, "Failed to create database", self.nodes[0].migratewallet, wallet_name)
+        wallet.unloadwallet()
+
+        # Verify the /wallets/ path exists.
+        assert (self.nodes[0].chain_path / "wallets").exists()
+
+        # Verify survive is still there
+        assert survive_path.exists()
+        # Verify the wallet path exists.
+        assert Path(wallet_path / "wallet.dat").exists()
+
+        # The backup is named after the last component of the wallet's path, so
+        # path-style wallet names cannot escape the wallet directory.
+        backup_prefix = "default_wallet" if is_default else wallet_path.resolve().name
+        backup_path = wallet_path / f"{backup_prefix}_{mocked_time}.legacy.bak"
+        assert backup_path.exists()
+
+        with open(self.nodes[0].chain_path / "wallets" / wallet_name / self.wallet_data_filename, "rb") as f:
+            data = f.read(16)
+            _, _, magic = struct.unpack("QII", data)
+            assert_equal(magic, BTREE_MAGIC)
+
+        survive_path.unlink()
+
+        # Cleanup
+        if is_default:
+            self.clear_default_wallet(backup_path)
+        else:
+            backup_path.unlink()
+            Path(watch_only_dir / "wallet.dat").unlink()
+            Path(watch_only_dir).rmdir()
+            Path(wallet_path / "wallet.dat").unlink()
+
 
     def test_direct_file(self):
         self.log.info("Test migration of a wallet that is not in a wallet directory")
@@ -696,6 +829,239 @@ def test_hybrid_pubkey(self):
 
         wallet.unloadwallet()
 
+    def test_conflict_txs(self):
+        self.log.info("Test migration when wallet contains conflicting transactions")
+        def_wallet = self.nodes[0].get_wallet_rpc(self.default_wallet_name)
+
+        wallet = self.create_legacy_wallet("conflicts")
+        def_wallet.sendtoaddress(wallet.getnewaddress(), 10)
+        self.generate(self.nodes[0], 1)
+
+        # parent tx
+        parent_txid = wallet.sendtoaddress(wallet.getnewaddress(), 9)
+        parent_txid_bytes = bytes.fromhex(parent_txid)[::-1]
+        conflict_utxo = wallet.gettransaction(txid=parent_txid, verbose=True)["decoded"]["vin"][0]
+
+        # The specific assertion in MarkConflicted being tested requires that the parent tx is already loaded
+        # by the time the child tx is loaded. Since transactions end up being loaded in txid order due to how both
+        # and sqlite store things, we can just grind the child tx until it has a txid that is greater than the parent's.
+        locktime = 500000000 # Use locktime as nonce, starting at unix timestamp minimum
+        addr = wallet.getnewaddress()
+        while True:
+            child_send_res = wallet.send(outputs=[{addr: 8}], options={"add_to_wallet": False, "locktime": locktime})
+            child_txid = child_send_res["txid"]
+            child_txid_bytes = bytes.fromhex(child_txid)[::-1]
+            if (child_txid_bytes > parent_txid_bytes):
+                wallet.sendrawtransaction(child_send_res["hex"])
+                break
+            locktime += 1
+
+        # conflict with parent
+        conflict_unsigned = self.nodes[0].createrawtransaction(inputs=[conflict_utxo], outputs=[{wallet.getnewaddress(): 9.9999}])
+        conflict_signed = wallet.signrawtransactionwithwallet(conflict_unsigned)["hex"]
+        conflict_txid = self.nodes[0].decoderawtransaction(conflict_signed)["txid"]
+        # Dash has no RBF, so the conflicting tx cannot be broadcast while the parent is in
+        # the mempool. Mine it directly into a block instead, which conflicts the parent and
+        # the child just the same.
+        self.generateblock(self.nodes[0], output=def_wallet.getnewaddress(), transactions=[conflict_signed])
+        assert_equal(wallet.gettransaction(txid=parent_txid)["confirmations"], -1)
+        assert_equal(wallet.gettransaction(txid=child_txid)["confirmations"], -1)
+        assert_equal(wallet.gettransaction(txid=conflict_txid)["confirmations"], 1)
+
+        self.migrate_wallet(wallet)
+        assert_equal(wallet.gettransaction(txid=parent_txid)["confirmations"], -1)
+        assert_equal(wallet.gettransaction(txid=child_txid)["confirmations"], -1)
+        assert_equal(wallet.gettransaction(txid=conflict_txid)["confirmations"], 1)
+
+        wallet.unloadwallet()
+
+    def test_addressbook(self):
+        df_wallet = self.nodes[0].get_wallet_rpc(self.default_wallet_name)
+
+        self.log.info("Test migration of address book data")
+        wallet = self.create_legacy_wallet("legacy_addrbook")
+        df_wallet.sendtoaddress(wallet.getnewaddress(), 3)
+
+        # Import watch-only script to create a watch-only wallet after migration
+        watch_addr = df_wallet.getnewaddress()
+        wallet.importaddress(watch_addr)
+        df_wallet.sendtoaddress(watch_addr, 2)
+
+        # Import solvable script
+        multi_addr1 = wallet.getnewaddress()
+        multi_addr2 = wallet.getnewaddress()
+        multi_addr3 = df_wallet.getnewaddress()
+        wallet.importpubkey(df_wallet.getaddressinfo(multi_addr3)["pubkey"])
+        ms_addr_info = wallet.addmultisigaddress(2, [multi_addr1, multi_addr2, multi_addr3])
+
+        self.generate(self.nodes[0], 1)
+
+        # Test vectors
+        addr_external = {
+            "addr": df_wallet.getnewaddress(),
+            "is_mine": False,
+            "is_change": False,
+            "label": ""
+        }
+        addr_external_with_label = {
+            "addr": df_wallet.getnewaddress(),
+            "is_mine": False,
+            "is_change": False,
+            "label": "external"
+        }
+        addr_internal = {
+            "addr": wallet.getnewaddress(),
+            "is_mine": True,
+            "is_change": False,
+            "label": ""
+        }
+        addr_internal_with_label = {
+            "addr": wallet.getnewaddress(),
+            "is_mine": True,
+            "is_change": False,
+            "label": "internal"
+        }
+        change_address = {
+            "addr": wallet.getrawchangeaddress(),
+            "is_mine": True,
+            "is_change": True,
+            "label": None
+        }
+        watch_only_addr = {
+            "addr": watch_addr,
+            "is_mine": False,
+            "is_change": False,
+            "label": "imported"
+        }
+        ms_addr = {
+            "addr": ms_addr_info['address'],
+            "is_mine": False,
+            "is_change": False,
+            "label": "multisig"
+        }
+
+        # To store the change address in the addressbook need to send coins to it
+        wallet.send(outputs=[{wallet.getnewaddress(): 2}], options={"change_address": change_address['addr']})
+        self.generate(self.nodes[0], 1)
+
+        # Util wrapper func for 'addr_info'
+        def check(info, node):
+            self.check_address(node, info['addr'], info['is_mine'], info['is_change'], info["label"])
+
+        # Pre-migration: set label and perform initial checks
+        for addr_info in [addr_external, addr_external_with_label, addr_internal, addr_internal_with_label, change_address, watch_only_addr, ms_addr]:
+            if not addr_info['is_change']:
+                wallet.setlabel(addr_info['addr'], addr_info["label"])
+            check(addr_info, wallet)
+
+        # Migrate wallet
+        info_migration = wallet.migratewallet()
+        wallet_wo = self.nodes[0].get_wallet_rpc(info_migration["watchonly_name"])
+        wallet_solvables = self.nodes[0].get_wallet_rpc(info_migration["solvables_name"])
+
+        #########################
+        # Post migration checks #
+        #########################
+
+        # First check the main wallet
+        for addr_info in [addr_external, addr_external_with_label, addr_internal, addr_internal_with_label, change_address, ms_addr]:
+            check(addr_info, wallet)
+
+        # Watch-only wallet will contain the watch-only entry (with 'is_mine=True') and all external addresses ('send')
+        self.check_address(wallet_wo, watch_only_addr['addr'], is_mine=True, is_change=watch_only_addr['is_change'], label=watch_only_addr["label"])
+        for addr_info in [addr_external, addr_external_with_label, ms_addr]:
+            check(addr_info, wallet_wo)
+
+        # Solvables wallet will contain the multisig entry (with 'is_mine=True') and all external addresses ('send')
+        self.check_address(wallet_solvables, ms_addr['addr'], is_mine=True, is_change=ms_addr['is_change'], label=ms_addr["label"])
+        for addr_info in [addr_external, addr_external_with_label]:
+            check(addr_info, wallet_solvables)
+
+        ########################################################################################
+        # Now restart migrated wallets and verify that the addressbook entries are still there #
+        ########################################################################################
+
+        # First the main wallet
+        self.nodes[0].unloadwallet("legacy_addrbook")
+        self.nodes[0].loadwallet("legacy_addrbook")
+        for addr_info in [addr_external, addr_external_with_label, addr_internal, addr_internal_with_label, change_address, ms_addr]:
+            check(addr_info, wallet)
+
+        # Watch-only wallet
+        self.nodes[0].unloadwallet(info_migration["watchonly_name"])
+        self.nodes[0].loadwallet(info_migration["watchonly_name"])
+        self.check_address(wallet_wo, watch_only_addr['addr'], is_mine=True, is_change=watch_only_addr['is_change'], label=watch_only_addr["label"])
+        for addr_info in [addr_external, addr_external_with_label, ms_addr]:
+            check(addr_info, wallet_wo)
+
+        # Solvables wallet
+        self.nodes[0].unloadwallet(info_migration["solvables_name"])
+        self.nodes[0].loadwallet(info_migration["solvables_name"])
+        self.check_address(wallet_solvables, ms_addr['addr'], is_mine=True, is_change=ms_addr['is_change'], label=ms_addr["label"])
+        for addr_info in [addr_external, addr_external_with_label]:
+            check(addr_info, wallet_solvables)
+
+    def test_failed_migration_cleanup(self):
+        self.log.info("Test that a failed migration is cleaned up")
+        wallet = self.create_legacy_wallet("failed")
+
+        # Make a copy of the wallet with the solvables wallet name so that we are unable
+        # to create the solvables wallet when migrating, thus failing to migrate
+        wallet.unloadwallet()
+        solvables_path = self.nodes[0].chain_path / "wallets" / "failed_solvables"
+        shutil.copytree(self.nodes[0].chain_path / "wallets" / "failed", solvables_path)
+        original_shasum = sha256sum_file(solvables_path / "wallet.dat")
+
+        self.nodes[0].loadwallet("failed")
+
+        # Add a multisig so that a solvables wallet is created
+        wallet.addmultisigaddress(2, [wallet.getnewaddress(), get_generate_key().pubkey])
+        wallet.importaddress(get_generate_key().p2pkh_addr)
+
+        assert_raises_rpc_error(-4, "Failed to create database", wallet.migratewallet)
+
+        assert "failed" in self.nodes[0].listwallets()
+        assert "failed_watchonly" not in self.nodes[0].listwallets()
+        assert "failed_solvables" not in self.nodes[0].listwallets()
+
+        assert not (self.nodes[0].chain_path / "wallets" / "failed_watchonly").exists()
+        # Since the file in failed_solvables is one that we put there, migration shouldn't touch it
+        assert solvables_path.exists()
+        new_shasum = sha256sum_file(solvables_path / "wallet.dat")
+        assert_equal(original_shasum, new_shasum)
+
+        wallet.unloadwallet()
+        # Check the wallet we tried to migrate is still BDB
+        with open(self.nodes[0].chain_path / "wallets" / "failed" / "wallet.dat", "rb") as f:
+            data = f.read(16)
+            _, _, magic = struct.unpack("QII", data)
+            assert_equal(magic, BTREE_MAGIC)
+
+    def unsynced_wallet_on_pruned_node_fails(self):
+        self.log.info("Test migration of an unsynced wallet on a pruned node fails gracefully")
+        shutil.rmtree(self.nodes[0].chain_path / "wallets" / "database", ignore_errors=True)
+        wallet = self.create_legacy_wallet("", load_on_startup=False)
+        last_wallet_synced_block = wallet.getwalletinfo()['lastprocessedblock']['height']
+
+        # Generate blocks just so the wallet best block is pruned.
+        # Dash's small early regtest blocks fill the first -fastprune block file up
+        # to height ~320, so mine and prune further than upstream to remove it.
+        self.restart_node(0, ["-fastprune", "-prune=1", "-nowallet"])
+        self.generate(self.nodes[0], 600, sync_fun=self.no_op)
+        self.nodes[0].pruneblockchain(400)
+        # Ensure next block to sync is unavailable
+        assert_raises_rpc_error(-1, "Block not available (pruned data)", self.nodes[0].getblock, self.nodes[0].getblockhash(last_wallet_synced_block + 1))
+
+        # Check migration failure
+        mocked_time = self.mocktime
+        assert_raises_rpc_error(-4, "last wallet synchronisation goes beyond pruned data. You need to -reindex (download the whole blockchain again in case of pruned node)\nUnable to restore backup of wallet.", self.nodes[0].migratewallet, wallet_name="")
+
+        # The wallet will not have been restored, and the backup will be in the wallets directory.
+        backup_path = self.nodes[0].chain_path / "wallets" / f"default_wallet_{mocked_time}.legacy.bak"
+        assert backup_path.exists()
+        # v24.0.x still warns on stderr that a pruned node runs without governance validation
+        self.stop_node(0, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+
     def run_test(self):
         self.generate(self.nodes[0], 101)
 
@@ -709,10 +1075,27 @@ def run_test(self):
         self.test_unloaded()
         self.test_unloaded_by_path()
         self.test_wallet_name_with_slashes()
+
+        migration_failure_cases = [
+            "",
+            "../",
+            os.path.abspath(os.path.join(self.nodes[0].datadir, "absolute_path")),
+            "normallynamedwallet"
+        ]
+        for wallet_name in migration_failure_cases:
+            self.test_migration_failure(wallet_name=wallet_name)
+
         self.test_default_wallet()
+        self.test_default_wallet_watch_only()
         self.test_direct_file()
         self.test_migrate_raw_p2sh()
         self.test_hybrid_pubkey()
+        self.test_conflict_txs()
+        self.test_addressbook()
+        self.test_failed_migration_cleanup()
+
+        # Note: After this test the first block file of 'nodes[0]' is pruned
+        self.unsynced_wallet_on_pruned_node_fails()
 
 if __name__ == '__main__':
     WalletMigrationTest().main()
diff --git a/test/util/data/non-backported.txt b/test/util/data/non-backported.txt
index 9b4c7e20023d..a616995691fd 100644
--- a/test/util/data/non-backported.txt
+++ b/test/util/data/non-backported.txt
@@ -96,6 +96,7 @@ src/test/unordered_lru_cache_tests.cpp
 src/test/util/llmq_tests.h
 src/test/util/masternode.*
 src/test/governance*.cpp
+src/test/index_migration_tests.cpp
 src/unordered_lru_cache.h
 src/util/edge.*
 src/util/helpers.h