blvm_consensus/script/

mod.rs

//! Script execution engine from Orange Paper Section 5.2
//!
//! Performance optimizations (VM):
#![allow(
    clippy::declare_interior_mutable_const,  // const vs static for OnceLock in array init
    clippy::type_complexity,
    clippy::too_many_arguments,
    clippy::needless_return,  // Many branches; mechanical fix error-prone
)]
//! - Secp256k1 context reuse (thread-local, zero-cost abstraction)
//! - Script result caching (production feature only, maintains correctness)
//! - Hash operation result caching (OP_HASH160, OP_HASH256)
//! - Stack pooling (thread-local pool of pre-allocated `Vec<StackElement>`)
//! - Memory allocation optimizations
//!
//! **Test vs production graph:** fast paths, LRU script cache, and batch verification are
//! behind `feature = "production"`. That feature is **on by default** in `Cargo.toml`
//! (`default = ["production", "blvm-secp256k1"]`), so normal `cargo test` matches the release
//! node interpreter. Use `cargo test --no-default-features` only when intentionally exercising
//! the minimal non-production graph.

mod arithmetic;
mod context;
mod control_flow;
mod crypto_ops;
pub mod flags;
mod signature;
mod stack;
pub mod templates;

#[cfg(feature = "production")]
pub use signature::{batch_verify_signatures, verify_pre_extracted_ecdsa};
pub use stack::{StackElement, cast_to_bool, to_stack_element};

use crate::constants::*;
use crate::crypto::OptimizedSha256;
use crate::error::{ConsensusError, Result, ScriptErrorCode};
use crate::opcodes::*;
use crate::types::*;
#[cfg(feature = "spec-lock")]
use blvm_spec_lock::spec_locked;
use digest::Digest;
use ripemd::Ripemd160;

// LLVM-like optimizations
#[cfg(feature = "production")]
use crate::optimizations::{precomputed_constants, prefetch};

// Cold error construction helpers - these paths are rarely taken
#[cold]
#[allow(dead_code)]
fn make_operation_limit_error() -> ConsensusError {
    ConsensusError::ScriptErrorWithCode {
        code: ScriptErrorCode::OpCount,
        message: "Operation limit exceeded".into(),
    }
}

/// CHECKMULTISIG counts each executed pubkey toward the 201-opcode limit.
///
/// The opcode itself is already counted. `n` is added only when it decodes and
/// is in `0..=20`, and only on an executing non-tapscript path. A count the
/// handler will reject is left unchanged.
#[inline]
fn charge_checkmultisig_pubkeys(stack: &[StackElement], op_count: usize) -> Result<usize> {
    let Some(n_bytes) = stack.last() else {
        return Ok(op_count);
    };
    let Ok(n_raw) = script_num_decode(n_bytes, 4) else {
        return Ok(op_count);
    };
    if !(0..=20).contains(&n_raw) {
        return Ok(op_count);
    }
    let next = op_count.saturating_add(n_raw as usize);
    if next > MAX_SCRIPT_OPS {
        return Err(make_operation_limit_error());
    }
    Ok(next)
}

#[inline]
fn script_bool_bytes(value: bool) -> &'static [u8] {
    if value { &[1] } else { &[] }
}

#[cold]
fn make_stack_overflow_error() -> ConsensusError {
    ConsensusError::ScriptErrorWithCode {
        code: ScriptErrorCode::StackSize,
        message: "Stack overflow".into(),
    }
}

#[inline]
fn bip143_p2wpkh_script_code(pubkey_hash: &[u8]) -> [u8; 25] {
    let mut hash = [0u8; 20];
    hash.copy_from_slice(pubkey_hash);
    crate::transaction_hash::derive_bip143_script_code_p2wpkh(&hash)
}

#[cfg(feature = "production")]
use std::collections::VecDeque;
#[cfg(feature = "production")]
use std::sync::{
    OnceLock, RwLock,
    atomic::{AtomicBool, AtomicU64, Ordering},
};
#[cfg(feature = "production")]
use std::thread_local;

/// Script verification result cache (production feature only)
///
/// Caches scriptPubKey verification results to avoid re-execution of identical scripts.
/// Cache is bounded (LRU) and invalidated on consensus changes.
/// Reference: Orange Paper Section 13.1 explicitly mentions script caching.
#[cfg(feature = "production")]
static SCRIPT_CACHE: OnceLock<RwLock<lru::LruCache<u64, bool>>> = OnceLock::new();

/// Thread-local buffers for verify_soa_batch; reused to avoid per-batch allocs.
#[cfg(feature = "production")]
thread_local! {
    static SOA_BATCH_BUF: std::cell::RefCell<(
        Vec<[u8; 64]>,
        Vec<[u8; 32]>,
        Vec<[u8; 33]>,
        Vec<usize>,
        Vec<[u8; 32]>,
    )> = const { std::cell::RefCell::new((
        Vec::new(),
        Vec::new(),
        Vec::new(),
        Vec::new(),
        Vec::new(),
    )) };
}

/// Fast-path hit counters (production): verify that P2PK/P2PKH/P2SH/P2WPKH/P2WSH fast-paths are used.
/// Logged periodically from block validation; interpreter = scripts that fell through to full interpreter.
#[cfg(feature = "production")]
static FAST_PATH_P2PK: AtomicU64 = AtomicU64::new(0);
#[cfg(feature = "production")]
static FAST_PATH_P2PKH: AtomicU64 = AtomicU64::new(0);
#[cfg(feature = "production")]
static FAST_PATH_P2SH: AtomicU64 = AtomicU64::new(0);
#[cfg(feature = "production")]
static FAST_PATH_P2WPKH: AtomicU64 = AtomicU64::new(0);
#[cfg(feature = "production")]
static FAST_PATH_P2WSH: AtomicU64 = AtomicU64::new(0);
#[cfg(feature = "production")]
static FAST_PATH_P2TR: AtomicU64 = AtomicU64::new(0);
#[cfg(feature = "production")]
static FAST_PATH_UNEXEC_IF: AtomicU64 = AtomicU64::new(0);
#[cfg(feature = "production")]
static FAST_PATH_BARE_MULTISIG: AtomicU64 = AtomicU64::new(0);
#[cfg(feature = "production")]
static FAST_PATH_INTERPRETER: AtomicU64 = AtomicU64::new(0);

#[cfg(feature = "production")]
fn get_script_cache() -> &'static RwLock<lru::LruCache<u64, bool>> {
    SCRIPT_CACHE.get_or_init(|| {
        // Bounded cache: 100,000 entries (optimized for production workloads)
        // LRU eviction policy prevents unbounded memory growth
        // Increased from 50k to 100k for better hit rates in large mempools
        use lru::LruCache;
        use std::num::NonZeroUsize;
        RwLock::new(LruCache::new(NonZeroUsize::new(100_000).unwrap()))
    })
}

/// Stack pool for VM optimization (production feature only)
///
/// Thread-local pool of pre-allocated stacks to avoid allocation overhead.
/// Stacks are reused across script executions, significantly reducing memory allocations.
#[cfg(feature = "production")]
thread_local! {
    static STACK_POOL: std::cell::RefCell<VecDeque<Vec<StackElement>>> =
        std::cell::RefCell::new(VecDeque::with_capacity(10));
}

/// Get a stack from the pool, or create a new one if pool is empty
#[cfg(feature = "production")]
fn get_pooled_stack() -> Vec<StackElement> {
    STACK_POOL.with(|pool| {
        let mut pool = pool.borrow_mut();
        if let Some(mut stack) = pool.pop_front() {
            stack.clear();
            if stack.capacity() < 20 {
                stack.reserve(20);
            }
            stack
        } else {
            Vec::with_capacity(20)
        }
    })
}

/// RAII guard that returns stack to pool on drop. Use for interpreter fallback path.
#[cfg(feature = "production")]
struct PooledStackGuard(Vec<StackElement>);
#[cfg(feature = "production")]
impl Drop for PooledStackGuard {
    fn drop(&mut self) {
        return_pooled_stack(std::mem::take(&mut self.0));
    }
}

/// Return a stack to the pool for reuse
#[cfg(feature = "production")]
fn return_pooled_stack(mut stack: Vec<StackElement>) {
    // Clear stack but preserve capacity
    stack.clear();

    STACK_POOL.with(|pool| {
        let mut pool = pool.borrow_mut();
        // Limit pool size to prevent unbounded growth
        if pool.len() < 10 {
            pool.push_back(stack);
        }
        // If pool is full, stack is dropped (deallocated)
    });
}

/// Flag to disable caching for benchmarking (production feature only)
///
/// When set to true, caches are bypassed entirely, allowing reproducible benchmarks
/// without cache state pollution between runs.
#[cfg(feature = "production")]
static CACHE_DISABLED: AtomicBool = AtomicBool::new(false);

/// When true, `verify_script_with_context_full` skips fast paths (P4.2 differential harness).
#[cfg(feature = "production")]
static FAST_PATHS_DISABLED: AtomicBool = AtomicBool::new(false);

/// Disable caching for benchmarking
///
/// When disabled, all cache lookups are bypassed, ensuring consistent performance
/// measurements without cache state affecting results.
///
/// # Example
///
/// ```rust
/// use blvm_consensus::script::disable_caching;
///
/// // Disable caches for benchmarking
/// disable_caching(true);
/// // Run benchmarks...
/// disable_caching(false); // Re-enable for production
/// ```
#[cfg(feature = "production")]
pub fn disable_caching(disabled: bool) {
    CACHE_DISABLED.store(disabled, Ordering::Relaxed);
}

/// Skip script fast paths so results come from the full interpreter (P4.2 equivalence tests).
#[cfg(feature = "production")]
pub fn disable_fast_paths(disabled: bool) {
    FAST_PATHS_DISABLED.store(disabled, Ordering::Relaxed);
}

/// Check if caching is disabled
#[cfg(feature = "production")]
fn is_caching_disabled() -> bool {
    CACHE_DISABLED.load(Ordering::Relaxed)
}

#[cfg(feature = "production")]
fn fast_paths_disabled() -> bool {
    FAST_PATHS_DISABLED.load(Ordering::Relaxed)
}

/// Compute cache key for script verification (SHA256 prefix — not `DefaultHasher`).
#[cfg(feature = "production")]
fn compute_script_cache_key(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    witness: Option<&ByteString>,
    flags: u32,
) -> u64 {
    use sha2::{Digest, Sha256};

    let mut hasher = Sha256::new();
    hasher.update((script_sig.len() as u64).to_le_bytes());
    hasher.update(&script_sig[..]);
    hasher.update((script_pubkey.len() as u64).to_le_bytes());
    hasher.update(script_pubkey);
    if let Some(w) = witness {
        hasher.update((w.len() as u64).to_le_bytes());
        hasher.update(&w[..]);
    } else {
        hasher.update(0u64.to_le_bytes());
    }
    hasher.update(flags.to_le_bytes());
    let digest = hasher.finalize();
    u64::from_le_bytes(digest[0..8].try_into().expect("sha256 prefix"))
}

/// Script version for policy/consensus behavior (BIP141/BIP341 SigVersion)
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum SigVersion {
    /// Legacy and P2SH scripts
    Base,
    /// Witness v0 (P2WPKH/P2WSH)
    WitnessV0,
    /// Taproot script path (witness v1 Tapscript)
    Tapscript,
}

/// EvalScript: 𝒮𝒞 × 𝒮𝒯 × ℕ × SigVersion → {true, false}
///
/// Script execution follows a stack-based virtual machine:
/// 1. Initialize stack S = ∅
/// 2. For each opcode op in script:
///    - If |S| > L_stack: return false (stack overflow)
///    - If operation count > L_ops: return false (operation limit exceeded)
///    - Execute op with current stack state
///    - If execution fails: return false
/// 3. Return true if execution completed without error (final stack shape is
///    checked by [`verify_script`] / [`verify_script_with_context_full`], not here).
///
/// Performance: Pre-allocates stack with capacity hint to reduce allocations
///
/// In production mode, stacks should be obtained from pool using get_pooled_stack()
/// for optimal performance. This function works with any Vec<StackElement>.
#[cfg_attr(feature = "spec-lock", spec_locked("5.2", "EvalScript"))]
#[cfg_attr(feature = "production", inline(always))]
#[cfg_attr(not(feature = "production"), inline)]
pub fn eval_script(
    script: &[u8],
    stack: &mut Vec<StackElement>,
    flags: u32,
    sigversion: SigVersion,
) -> Result<bool> {
    // Pre-allocate stack capacity to reduce allocations during execution
    // Most scripts don't exceed 20 stack items in practice
    if stack.capacity() < 20 {
        stack.reserve(20);
    }
    #[cfg(feature = "production")]
    {
        eval_script_impl(script, stack, flags, sigversion)
    }
    #[cfg(not(feature = "production"))]
    {
        eval_script_inner(script, stack, flags, sigversion)
    }
}
#[cfg(feature = "production")]
fn eval_script_impl(
    script: &[u8],
    stack: &mut Vec<StackElement>,
    flags: u32,
    sigversion: SigVersion,
) -> Result<bool> {
    eval_script_inner(script, stack, flags, sigversion)
}

/// Push opcodes: any opcode <= OP_16 (0x60). Used by both production and non-production paths.
#[inline(always)]
pub(crate) fn is_push_opcode(opcode: u8) -> bool {
    opcode <= 0x60
}

/// BIP342: opcodes that cause immediate script success in Tapscript (OP_SUCCESSx).
/// Reference: BIP342 successful witness opcodes (IsOpSuccess).
#[inline]
pub(crate) fn is_op_success(opcode: u8) -> bool {
    matches!(
        opcode,
        80 | 98
            | 126..=129
            | 131..=134
            | 137..=138
            | 141..=142
            | 149..=153
            | 187..=254
    )
}

/// Opcodes that fail even when the current branch does not execute.
///
/// The numeric disabled set is not `OP_2MUL..=OP_RSHIFT`: that span includes
/// `OP_NEGATE`, `OP_ABS`, `OP_NOT`, `OP_0NOTEQUAL`, `OP_ADD`, and `OP_SUB`.
fn dead_branch_opcode_error(opcode: u8) -> Option<ScriptErrorCode> {
    let disabled = matches!(
        opcode,
        OP_CAT..=OP_RIGHT
            | OP_INVERT..=OP_XOR
            | OP_2MUL
            | OP_2DIV
            | OP_MUL
            | OP_DIV
            | OP_MOD
            | OP_LSHIFT
            | OP_RSHIFT
    );
    if disabled {
        return Some(ScriptErrorCode::DisabledOpcode);
    }
    if opcode == OP_VERIF || opcode == OP_VERNOTIF {
        return Some(ScriptErrorCode::BadOpcode);
    }
    None
}

/// Advance past one opcode + its push data in a script byte slice.
/// Returns the number of bytes to skip (always >= 1).
#[inline]
pub(crate) fn op_advance(script: &[u8], pc: usize) -> usize {
    let opcode = script[pc];
    match opcode {
        // direct push: opcode byte is the data length (1–75 bytes)
        0x01..=0x4b => 1 + opcode as usize,
        // OP_PUSHDATA1: 1 length byte follows
        0x4c => {
            if pc + 1 < script.len() {
                2 + script[pc + 1] as usize
            } else {
                1
            }
        }
        // OP_PUSHDATA2: 2 length bytes follow (LE)
        0x4d => {
            if pc + 2 < script.len() {
                3 + u16::from_le_bytes([script[pc + 1], script[pc + 2]]) as usize
            } else {
                1
            }
        }
        // OP_PUSHDATA4: 4 length bytes follow (LE)
        0x4e => {
            if pc + 4 < script.len() {
                5 + u32::from_le_bytes([
                    script[pc + 1],
                    script[pc + 2],
                    script[pc + 3],
                    script[pc + 4],
                ]) as usize
            } else {
                1
            }
        }
        _ => 1,
    }
}

/// End offset of the opcode at `pc`, or `None` when a push does not fit.
///
/// A short `OP_PUSHDATA*` header is not an opcode. The tapscript success scan
/// must stop there instead of reading the leftover length bytes as opcodes.
fn tapscript_opcode_end(script: &[u8], pc: usize) -> Option<usize> {
    let opcode = *script.get(pc)?;
    let end = if opcode == 0 {
        pc.checked_add(1)?
    } else if opcode <= 0x4b {
        pc.checked_add(1)?.checked_add(opcode as usize)?
    } else if opcode == OP_PUSHDATA1 {
        let len = *script.get(pc + 1)? as usize;
        pc.checked_add(2)?.checked_add(len)?
    } else if opcode == OP_PUSHDATA2 {
        if pc + 2 >= script.len() {
            return None;
        }
        let len = u16::from_le_bytes([script[pc + 1], script[pc + 2]]) as usize;
        pc.checked_add(3)?.checked_add(len)?
    } else if opcode == OP_PUSHDATA4 {
        if pc + 4 >= script.len() {
            return None;
        }
        let len = u32::from_le_bytes([
            script[pc + 1],
            script[pc + 2],
            script[pc + 3],
            script[pc + 4],
        ]) as usize;
        pc.checked_add(5)?.checked_add(len)?
    } else {
        pc.checked_add(1)?
    };
    (end <= script.len()).then_some(end)
}

/// A push has one shortest encoding. `SCRIPT_VERIFY_MINIMALDATA` rejects the longer ones.
fn push_encoding_is_minimal(opcode: u8, data: &[u8]) -> bool {
    if data.is_empty() {
        return opcode == OP_0;
    }
    if data.len() == 1 {
        let byte = data[0];
        if (1..=16).contains(&byte) {
            return opcode == OP_1 + (byte - 1);
        }
        if byte == 0x81 {
            return opcode == OP_1NEGATE;
        }
    }
    if data.len() <= 75 {
        return opcode == data.len() as u8;
    }
    if data.len() <= 255 {
        return opcode == OP_PUSHDATA1;
    }
    if data.len() <= 65535 {
        return opcode == OP_PUSHDATA2;
    }
    true
}

/// Pop an executing `OP_IF` / `OP_NOTIF` condition and enforce MINIMALIF.
///
/// The caller builds the `ControlBlock` and, in the context interpreter, advances `i`.
fn pop_if_condition(
    stack: &mut Vec<StackElement>,
    flags: u32,
    sigversion: SigVersion,
    minimal_message: &'static str,
) -> Result<bool> {
    let condition_bytes = stack.pop().unwrap();
    let condition = cast_to_bool(&condition_bytes);
    let enforce_minimal_if = sigversion == SigVersion::Tapscript
        || (sigversion == SigVersion::WitnessV0 && flags & flags::SCRIPT_VERIFY_MINIMALIF != 0);
    if enforce_minimal_if && !control_flow::is_minimal_if_condition(&condition_bytes) {
        return Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::MinimalIf,
            message: minimal_message.into(),
        });
    }
    Ok(condition)
}

/// Decode one data push and, unless `in_false_branch`, put it on `stack`.
///
/// `Ok(None)` is a failed script (truncated push or non-minimal encoding).
/// A push larger than [`MAX_SCRIPT_ELEMENT_SIZE`] is an error.
fn apply_data_push(
    script: &[u8],
    i: usize,
    opcode: u8,
    stack: &mut Vec<StackElement>,
    flags: u32,
    in_false_branch: bool,
) -> Result<Option<usize>> {
    let (data, advance) = if opcode <= 0x4b {
        let len = opcode as usize;
        if i + 1 + len > script.len() {
            return Ok(None);
        }
        (&script[i + 1..i + 1 + len], 1 + len)
    } else if opcode == OP_PUSHDATA1 {
        if i + 1 >= script.len() {
            return Ok(None);
        }
        let len = script[i + 1] as usize;
        if i + 2 + len > script.len() {
            return Ok(None);
        }
        (&script[i + 2..i + 2 + len], 2 + len)
    } else if opcode == OP_PUSHDATA2 {
        if i + 2 >= script.len() {
            return Ok(None);
        }
        let len = u16::from_le_bytes([script[i + 1], script[i + 2]]) as usize;
        if i + 3 + len > script.len() {
            return Ok(None);
        }
        (&script[i + 3..i + 3 + len], 3 + len)
    } else {
        if i + 4 >= script.len() {
            return Ok(None);
        }
        let len = u32::from_le_bytes([script[i + 1], script[i + 2], script[i + 3], script[i + 4]])
            as usize;
        let data_start = i.saturating_add(5);
        let data_end = data_start.saturating_add(len);
        let advance = 5usize.saturating_add(len);
        if advance < 5 || data_end > script.len() || data_end < data_start {
            return Ok(None);
        }
        (&script[data_start..data_end], advance)
    };

    if data.len() > MAX_SCRIPT_ELEMENT_SIZE {
        return Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::PushSize,
            message: format!(
                "Push data size {} exceeds maximum {}",
                data.len(),
                MAX_SCRIPT_ELEMENT_SIZE
            )
            .into(),
        });
    }
    if !in_false_branch
        && (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
        && !push_encoding_is_minimal(opcode, data)
    {
        return Ok(None);
    }
    if !in_false_branch {
        stack.push(to_stack_element(data));
    }
    Ok(Some(advance))
}

fn eval_script_inner(
    script: &[u8],
    stack: &mut Vec<StackElement>,
    flags: u32,
    sigversion: SigVersion,
) -> Result<bool> {
    use crate::constants::MAX_SCRIPT_SIZE;
    use crate::error::{ConsensusError, ScriptErrorCode};

    if (sigversion == SigVersion::Base || sigversion == SigVersion::WitnessV0)
        && script.len() > MAX_SCRIPT_SIZE
    {
        return Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::ScriptSize,
            message: "Script size exceeds maximum".into(),
        });
    }

    let mut op_count = 0;
    let mut control_stack: Vec<control_flow::ControlBlock> = Vec::new();
    let mut altstack: Vec<StackElement> = Vec::new();

    let mut i = 0;
    // The combined stack limit is applied after an opcode finishes, not before it runs.
    let mut finished_opcode = false;
    while i < script.len() {
        if finished_opcode && stack.len() + altstack.len() > MAX_STACK_SIZE {
            return Err(make_stack_overflow_error());
        }
        finished_opcode = true;
        let opcode = script[i];
        let in_false_branch = control_flow::in_false_branch(&control_stack);

        // Count non-push opcodes toward op limit (Base/WitnessV0 only; BIP342 Tapscript has no 201-op cap).
        // nOpCount only for BASE || WITNESS_V0 (BIP342 Tapscript exempt).
        if sigversion != SigVersion::Tapscript && !is_push_opcode(opcode) {
            op_count += 1;
            if op_count > MAX_SCRIPT_OPS {
                return Err(make_operation_limit_error());
            }
            debug_assert!(
                op_count <= MAX_SCRIPT_OPS,
                "Operation count ({op_count}) must not exceed MAX_SCRIPT_OPS ({MAX_SCRIPT_OPS})"
            );
        }

        // Handle push opcodes with embedded data (0x01-0x4b direct, OP_PUSHDATA1/2/4).
        if (0x01..=OP_PUSHDATA4).contains(&opcode) {
            let Some(advance) = apply_data_push(script, i, opcode, stack, flags, in_false_branch)?
            else {
                return Ok(false);
            };
            i += advance;
            continue;
        }

        match opcode {
            // OP_IF
            OP_IF => {
                if in_false_branch {
                    control_stack.push(control_flow::ControlBlock::If { executing: false });
                } else if stack.is_empty() {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::InvalidStackOperation,
                        message: "OP_IF: empty stack".into(),
                    });
                } else {
                    let condition = pop_if_condition(
                        stack,
                        flags,
                        sigversion,
                        "OP_IF condition must be minimally encoded",
                    )?;
                    control_stack.push(control_flow::ControlBlock::If {
                        executing: condition,
                    });
                }
            }
            // OP_NOTIF
            OP_NOTIF => {
                if in_false_branch {
                    control_stack.push(control_flow::ControlBlock::NotIf { executing: false });
                } else if stack.is_empty() {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::InvalidStackOperation,
                        message: "OP_NOTIF: empty stack".into(),
                    });
                } else {
                    let condition = pop_if_condition(
                        stack,
                        flags,
                        sigversion,
                        "OP_NOTIF condition must be minimally encoded",
                    )?;
                    control_stack.push(control_flow::ControlBlock::NotIf {
                        executing: !condition,
                    });
                }
            }
            // OP_ELSE
            OP_ELSE => {
                if let Some(block) = control_stack.last_mut() {
                    match block {
                        control_flow::ControlBlock::If { executing }
                        | control_flow::ControlBlock::NotIf { executing } => {
                            *executing = !*executing;
                        }
                    }
                } else {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::UnbalancedConditional,
                        message: "OP_ELSE without matching IF/NOTIF".into(),
                    });
                }
            }
            // OP_ENDIF
            OP_ENDIF => {
                if control_stack.pop().is_none() {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::UnbalancedConditional,
                        message: "OP_ENDIF without matching IF/NOTIF".into(),
                    });
                }
            }
            // OP_TOALTSTACK - move top stack item to altstack
            OP_TOALTSTACK => {
                if !in_false_branch {
                    if stack.is_empty() {
                        return Err(ConsensusError::ScriptErrorWithCode {
                            code: ScriptErrorCode::InvalidStackOperation,
                            message: "OP_TOALTSTACK: empty stack".into(),
                        });
                    }
                    altstack.push(stack.pop().unwrap());
                }
            }
            // OP_FROMALTSTACK - move top altstack item to stack
            OP_FROMALTSTACK => {
                if !in_false_branch {
                    if altstack.is_empty() {
                        return Err(ConsensusError::ScriptErrorWithCode {
                            code: ScriptErrorCode::InvalidAltstackOperation,
                            message: "OP_FROMALTSTACK: empty altstack".into(),
                        });
                    }
                    stack.push(altstack.pop().unwrap());
                }
            }
            _ => {
                if in_false_branch {
                    if let Some(code) = dead_branch_opcode_error(opcode) {
                        return Err(ConsensusError::ScriptErrorWithCode {
                            code,
                            message: format!(
                                "opcode 0x{opcode:02x} is invalid in an unexecuted branch"
                            )
                            .into(),
                        });
                    }
                    i += 1;
                    continue;
                }

                if sigversion != SigVersion::Tapscript
                    && (opcode == OP_CHECKMULTISIG || opcode == OP_CHECKMULTISIGVERIFY)
                {
                    op_count = charge_checkmultisig_pubkeys(stack, op_count)?;
                }
                if !execute_opcode(opcode, stack, flags, sigversion)? {
                    return Ok(false);
                }
            }
        }
        i += 1;
    }

    if finished_opcode && stack.len() + altstack.len() > MAX_STACK_SIZE {
        return Err(make_stack_overflow_error());
    }

    if !control_stack.is_empty() {
        return Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::UnbalancedConditional,
            message: "Unclosed IF/NOTIF block".into(),
        });
    }

    Ok(true)
}

/// VerifyScript: 𝒮𝒞 × 𝒮𝒞 × 𝒲 × ℕ → {true, false}
///
/// For scriptSig ss, scriptPubKey spk, witness w, and flags f:
/// 1. Execute ss on empty stack
/// 2. Execute spk on resulting stack
/// 3. If witness present: execute w on stack
/// 4. Return final stack has exactly one true value
///
/// After scriptSig and scriptPubKey, a P2SH output still has to run the redeem
/// script. The pubkey script only checked HASH160. `OP_RESERVED` in the redeem
/// script fails. The redeem runs only when `SCRIPT_VERIFY_P2SH` is set.
fn apply_p2sh_redeem(
    script_sig: &[u8],
    script_pubkey: &[u8],
    flags: u32,
    sigversion: SigVersion,
    stack: &mut Vec<StackElement>,
) -> Result<bool> {
    let is_p2sh = (flags & flags::SCRIPT_VERIFY_P2SH) != 0
        && script_pubkey.len() == 23
        && script_pubkey[0] == OP_HASH160
        && script_pubkey[1] == PUSH_20_BYTES
        && script_pubkey[22] == OP_EQUAL;
    if !is_p2sh {
        return Ok(true);
    }
    if stack.is_empty() || !cast_to_bool(&stack[stack.len() - 1]) {
        return Ok(false);
    }
    stack.pop();
    let Some(pushes) = parse_borrowed_pushes(script_sig) else {
        return Ok(false);
    };
    let Some(redeem) = pushes.last() else {
        return Ok(false);
    };
    eval_script(redeem.as_ref(), stack, flags, sigversion)
}

/// Legacy script verification (Base sigversion, at most one witness push).
///
/// **Deprecated**: accepts `Option<&ByteString>` not a full witness stack. SegWit and Taproot
/// inputs require [`verify_script_with_context`] or [`verify_script_with_context_full`].
#[deprecated(
    since = "0.1.33",
    note = "Use verify_script_with_context for witness-aware script verification"
)]
#[cfg_attr(feature = "spec-lock", spec_locked("5.2", "VerifyScript"))]
#[cfg_attr(feature = "production", inline(always))]
#[cfg_attr(not(feature = "production"), inline)]
pub fn verify_script(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    witness: Option<&ByteString>,
    flags: u32,
) -> Result<bool> {
    // P2SH: a non-push scriptSig is invalid before either script runs.
    if flags & flags::SCRIPT_VERIFY_P2SH != 0
        && script_pubkey.len() == 23
        && script_pubkey[0] == OP_HASH160
        && script_pubkey[1] == PUSH_20_BYTES
        && script_pubkey[22] == OP_EQUAL
        && !p2sh_push_only_check(script_sig)
    {
        return Ok(false);
    }

    // SigVersion is always Base for this API (no tx/witness context)
    let sigversion = SigVersion::Base;

    #[cfg(feature = "production")]
    {
        // Check cache first (unless disabled for benchmarking)
        if !is_caching_disabled() {
            let cache_key = compute_script_cache_key(script_sig, script_pubkey, witness, flags);
            {
                let cache = get_script_cache().read().unwrap_or_else(|e| e.into_inner());
                if let Some(&cached_result) = cache.peek(&cache_key) {
                    return Ok(cached_result);
                }
            }
        }

        // Execute script (cache miss)
        // Use pooled stack to avoid allocation
        let mut stack = get_pooled_stack();
        let cache_key = compute_script_cache_key(script_sig, script_pubkey, witness, flags);
        let result = {
            if !eval_script(script_sig, &mut stack, flags, sigversion)? {
                // Cache negative result (unless disabled)
                if !is_caching_disabled() {
                    let mut cache = get_script_cache()
                        .write()
                        .unwrap_or_else(|e| e.into_inner());
                    cache.put(cache_key, false);
                }
                false
            } else if !eval_script(script_pubkey, &mut stack, flags, sigversion)? {
                if !is_caching_disabled() {
                    let mut cache = get_script_cache()
                        .write()
                        .unwrap_or_else(|e| e.into_inner());
                    cache.put(cache_key, false);
                }
                false
            } else if !apply_p2sh_redeem(script_sig, script_pubkey, flags, sigversion, &mut stack)?
            {
                if !is_caching_disabled() {
                    let mut cache = get_script_cache()
                        .write()
                        .unwrap_or_else(|e| e.into_inner());
                    cache.put(cache_key, false);
                }
                false
            } else if let Some(w) = witness {
                if !eval_script(w, &mut stack, flags, sigversion)? {
                    if !is_caching_disabled() {
                        let mut cache = get_script_cache()
                            .write()
                            .unwrap_or_else(|e| e.into_inner());
                        cache.put(cache_key, false);
                    }
                    false
                } else {
                    let res = !stack.is_empty() && cast_to_bool(&stack[stack.len() - 1]);
                    if !is_caching_disabled() {
                        let mut cache = get_script_cache()
                            .write()
                            .unwrap_or_else(|e| e.into_inner());
                        cache.put(cache_key, res);
                    }
                    res
                }
            } else {
                let res = !stack.is_empty() && cast_to_bool(&stack[stack.len() - 1]);
                if !is_caching_disabled() {
                    let mut cache = get_script_cache()
                        .write()
                        .unwrap_or_else(|e| e.into_inner());
                    cache.put(cache_key, res);
                }
                res
            }
        };

        // Return stack to pool
        return_pooled_stack(stack);

        Ok(result)
    }

    #[cfg(not(feature = "production"))]
    {
        // Pre-allocate stack with capacity hint (most scripts use <20 items)
        let mut stack = Vec::with_capacity(20);

        // Execute scriptSig
        if !eval_script(script_sig, &mut stack, flags, sigversion)? {
            return Ok(false);
        }

        // Execute scriptPubkey
        if !eval_script(script_pubkey, &mut stack, flags, sigversion)? {
            return Ok(false);
        }
        if !apply_p2sh_redeem(script_sig, script_pubkey, flags, sigversion, &mut stack)? {
            return Ok(false);
        }

        // Execute witness if present
        if let Some(w) = witness {
            if !eval_script(w, &mut stack, flags, sigversion)? {
                return Ok(false);
            }
        }

        // Final validation: top of stack must be truthy (CastToBool on stack.back()).
        Ok(!stack.is_empty() && cast_to_bool(&stack[stack.len() - 1]))
    }
}

/// VerifyScript with transaction context for signature verification
///
/// This version includes the full transaction context needed for proper
/// Script verification with transaction context and optional block height.
///
/// Pass `block_height` whenever it is known; height-dependent fork rules (CLTV, CSV,
/// SegWit, Taproot) rely on it to select the correct evaluation path.  Passing `None`
/// falls back to height `0` inside the engine, which means pre-activation rules are
/// used — valid only for regtest / test-vector scenarios.
///
/// For callers that also need to supply a pre-computed sighash or a specific
/// `SigVersion`, use [`verify_script_with_context_full`] directly.
#[cfg_attr(feature = "spec-lock", spec_locked("5.2", "VerifyScript"))]
#[cfg_attr(feature = "production", inline(always))]
#[cfg_attr(not(feature = "production"), inline)]
#[allow(clippy::too_many_arguments)]
pub fn verify_script_with_context(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    witness: Option<&crate::witness::Witness>,
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevouts: &[TransactionOutput],
    block_height: Option<u64>,
    network: crate::types::Network,
) -> Result<bool> {
    // Convert prevouts to parallel slices for the optimized API
    let prevout_values: Vec<i64> = prevouts.iter().map(|p| p.value).collect();
    let prevout_script_pubkeys: Vec<&[u8]> =
        prevouts.iter().map(|p| p.script_pubkey.as_ref()).collect();

    verify_script_with_context_full(
        script_sig,
        script_pubkey,
        witness,
        flags,
        tx,
        input_index,
        &prevout_values,
        &prevout_script_pubkeys,
        block_height,
        None, // median_time_past
        network,
        SigVersion::Base, // _sigversion is ignored inside full; SigVersion is inferred from script
        #[cfg(feature = "production")]
        None, // schnorr_collector
        None,             // precomputed_bip143
        #[cfg(feature = "production")]
        None, // precomputed_sighash_all
        #[cfg(feature = "production")]
        None, // sighash_cache
        #[cfg(feature = "production")]
        None, // precomputed_p2pkh_hash
        #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
        None, // ecdsa_collect
    )
}

/// Bare pay-to-pubkey whose push opcode is the key length, then `OP_CHECKSIG`.
///
/// `PUSH_33_BYTES` is a 33-byte key. `PUSH_65_BYTES` is a 65-byte key. A push
/// that does not match the script length is not this template.
pub(crate) fn canonical_p2pk_pubkey(script: &[u8]) -> Option<&[u8]> {
    let key_len = match script.first().copied()? {
        PUSH_33_BYTES => PUSH_33_BYTES as usize,
        PUSH_65_BYTES => PUSH_65_BYTES as usize,
        _ => return None,
    };
    if script.len() != key_len + 2 || script[script.len() - 1] != OP_CHECKSIG {
        return None;
    }
    Some(&script[1..1 + key_len])
}

/// P2PK fast-path. Bare pay-to-pubkey: scriptPubKey is `pubkey` + OP_CHECKSIG, scriptSig is `sig`.
/// Common in early blocks (coinbase outputs). Returns Some(Ok(bool)) if handled; None to fall back.
/// Uses full transaction context (height, network) for BIP66 / signature validation.
///
/// For the Orange Paper **`VerifyScript`** contract (scriptSig + scriptPubKey + witness + flags),
/// see [`verify_script`], [`verify_script_with_context`], and [`verify_script_with_context_full`].
#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
pub fn try_verify_p2pk_fast_path(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    network: crate::types::Network,
    #[cfg(feature = "production")] sighash_cache: Option<
        &crate::transaction_hash::SighashMidstateCache,
    >,
) -> Option<Result<bool>> {
    let pubkey_bytes = canonical_p2pk_pubkey(script_pubkey)?;

    let signature_bytes = parse_p2pk_script_sig(script_sig.as_ref())?;
    if signature_bytes.is_empty() {
        return Some(Ok(false));
    }

    // Fast-path: P2PK script_pubkey is 35 or 67 bytes; signature push ≥71. Skip serialize+find_and_delete.
    use crate::transaction_hash::{SighashType, calculate_transaction_sighash_single_input};
    let sighash_byte = signature_bytes[signature_bytes.len() - 1];
    let sighash_type = SighashType::from_byte(sighash_byte);
    let deleted_storage;
    let script_code: &[u8] = if script_pubkey.len() < 71 {
        script_pubkey
    } else {
        deleted_storage = with_push_pattern(signature_bytes, |pattern| {
            find_and_delete(script_pubkey, pattern)
        });
        deleted_storage.as_ref()
    };
    let sighash = match calculate_transaction_sighash_single_input(
        tx,
        input_index,
        script_code,
        prevout_values[input_index],
        sighash_type,
        #[cfg(feature = "production")]
        sighash_cache,
    ) {
        Ok(h) => h,
        Err(e) => return Some(Err(e)),
    };

    let height = block_height.unwrap_or(0);
    let is_valid = signature::with_secp_context(|secp| {
        signature::verify_signature(
            secp,
            pubkey_bytes,
            signature_bytes,
            &sighash,
            flags,
            height,
            network,
            SigVersion::Base,
        )
    });
    Some(is_valid)
}

/// P2PKH fast-path. Returns Some(Ok(bool)) if script is P2PKH and we handled it;
/// Returns None to fall back to full interpreter.
#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
pub fn try_verify_p2pkh_fast_path(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    network: crate::types::Network,
    #[cfg(feature = "production")] precomputed_sighash_all: Option<[u8; 32]>,
    #[cfg(feature = "production")] sighash_cache: Option<
        &crate::transaction_hash::SighashMidstateCache,
    >,
    #[cfg(feature = "production")] precomputed_p2pkh_hash: Option<[u8; 20]>,
) -> Option<Result<bool>> {
    #[cfg(all(feature = "production", feature = "profile"))]
    let _t_entry = std::time::Instant::now();
    // P2PKH scriptPubKey: 25 bytes = OP_DUP OP_HASH160 PUSH_20_BYTES <20 bytes> OP_EQUALVERIFY OP_CHECKSIG
    if script_pubkey.len() != 25 {
        return None;
    }
    if script_pubkey[0] != OP_DUP
        || script_pubkey[1] != OP_HASH160
        || script_pubkey[2] != PUSH_20_BYTES
        || script_pubkey[23] != OP_EQUALVERIFY
        || script_pubkey[24] != OP_CHECKSIG
    {
        return None;
    }
    let expected_hash = &script_pubkey[3..23];

    #[cfg(all(feature = "production", feature = "profile"))]
    crate::script_profile::add_p2pkh_fast_path_entry_ns(_t_entry.elapsed().as_nanos() as u64);
    #[cfg(all(feature = "production", feature = "profile"))]
    let _t_parse = std::time::Instant::now();
    let (signature_bytes, pubkey_bytes) = parse_p2pkh_script_sig(script_sig.as_ref())?;
    #[cfg(all(feature = "production", feature = "profile"))]
    crate::script_profile::add_p2pkh_parse_ns(_t_parse.elapsed().as_nanos() as u64);

    // Pubkey must be 33 (compressed) or 65 (uncompressed) bytes
    if pubkey_bytes.len() != 33 && pubkey_bytes.len() != 65 {
        return Some(Ok(false));
    }
    // Empty signature is valid script but leaves 0 on stack -> verification false
    if signature_bytes.is_empty() {
        return Some(Ok(false));
    }

    // HASH160(pubkey) == expected hash (or use precomputed when provided by batch path)
    let pubkey_hash: [u8; 20] = match precomputed_p2pkh_hash {
        Some(h) => h,
        None => {
            #[cfg(all(feature = "production", feature = "profile"))]
            let _t_hash = std::time::Instant::now();
            let sha256_hash = OptimizedSha256::new().hash(pubkey_bytes);
            let h = Ripemd160::digest(sha256_hash);
            #[cfg(all(feature = "production", feature = "profile"))]
            crate::script_profile::add_p2pkh_hash160_ns(_t_hash.elapsed().as_nanos() as u64);
            h.into()
        }
    };
    if &pubkey_hash[..] != expected_hash {
        return Some(Ok(false));
    }

    // Legacy sighash: scriptCode = FindAndDelete(script_pubkey, serialize(signature))
    // Roadmap #12: use precomputed when available (batch sighash for P2PKH).
    use crate::transaction_hash::SighashType;
    let sighash_byte = signature_bytes[signature_bytes.len() - 1];
    let sighash_type = SighashType::from_byte(sighash_byte);
    let deleted_storage;
    let script_code: &[u8] = if script_pubkey.len() < 71 {
        script_pubkey
    } else {
        deleted_storage = with_push_pattern(signature_bytes, |pattern| {
            find_and_delete(script_pubkey, pattern)
        });
        deleted_storage.as_ref()
    };
    let sighash = {
        #[cfg(feature = "production")]
        {
            if let Some(precomp) = precomputed_sighash_all {
                precomp
            } else {
                crate::transaction_hash::compute_legacy_sighash_nocache(
                    tx,
                    input_index,
                    script_code,
                    sighash_byte,
                )
            }
        }
        #[cfg(not(feature = "production"))]
        {
            match calculate_transaction_sighash_single_input(
                tx,
                input_index,
                script_code,
                prevout_values[input_index],
                sighash_type,
            ) {
                Ok(h) => h,
                Err(e) => return Some(Err(e)),
            }
        }
    };

    #[cfg(all(feature = "production", feature = "profile"))]
    let _t_secp = std::time::Instant::now();
    let height = block_height.unwrap_or(0);
    let is_valid: Result<bool> = {
        let der_sig = &signature_bytes[..signature_bytes.len() - 1];
        if flags & 0x04 != 0
            && !crate::bip_validation::check_bip66_network(signature_bytes, height, network)
                .unwrap_or(false)
        {
            Ok(false)
        } else if flags & 0x02 != 0 {
            let base_sighash = sighash_byte & !0x80;
            if !(0x01..=0x03).contains(&base_sighash) {
                Ok(false)
            } else if pubkey_bytes.len() == 33 {
                if pubkey_bytes[0] != 0x02 && pubkey_bytes[0] != 0x03 {
                    Ok(false)
                } else {
                    let strict_der = flags & 0x04 != 0;
                    let enforce_low_s = flags & 0x08 != 0;
                    Ok(crate::secp256k1_backend::verify_ecdsa_direct(
                        der_sig,
                        pubkey_bytes,
                        &sighash,
                        strict_der,
                        enforce_low_s,
                    )
                    .unwrap_or(false))
                }
            } else if pubkey_bytes.len() == 65 && pubkey_bytes[0] == 0x04 {
                let strict_der = flags & 0x04 != 0;
                let enforce_low_s = flags & 0x08 != 0;
                Ok(crate::secp256k1_backend::verify_ecdsa_direct(
                    der_sig,
                    pubkey_bytes,
                    &sighash,
                    strict_der,
                    enforce_low_s,
                )
                .unwrap_or(false))
            } else {
                Ok(false)
            }
        } else {
            let strict_der = flags & 0x04 != 0;
            let enforce_low_s = flags & 0x08 != 0;
            Ok(crate::secp256k1_backend::verify_ecdsa_direct(
                der_sig,
                pubkey_bytes,
                &sighash,
                strict_der,
                enforce_low_s,
            )
            .unwrap_or(false))
        }
    };
    #[cfg(all(feature = "production", feature = "profile"))]
    {
        let ns = _t_secp.elapsed().as_nanos() as u64;
        crate::script_profile::add_p2pkh_collect_ns(ns);
        crate::script_profile::add_p2pkh_secp_context_ns(ns);
    }
    Some(is_valid)
}

/// Fully inlined P2PKH verification for the rayon fast path.
/// Caller MUST have already verified script_pubkey is a valid P2PKH (25 bytes, correct opcodes).
/// Eliminates: redundant pattern check, Option unwrapping for precomputed values (always None),
/// assumevalid lookup, sighash cache overhead.
/// Returns Ok(true/false) directly — no Option wrapping.
#[cfg(feature = "production")]
#[inline]
pub fn verify_p2pkh_inline(
    script_sig: &[u8],
    script_pubkey: &[u8],
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    height: u64,
    network: crate::types::Network,
    precomputed_sighash_all: Option<[u8; 32]>,
    precomputed_p2pkh_hash: Option<[u8; 20]>,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collect: Option<(
        &crate::ecdsa_batch::EcdsaSignatureCollector,
        usize,
    )>,
) -> Result<bool> {
    let (signature_bytes, pubkey_bytes) = match parse_p2pkh_script_sig(script_sig) {
        Some(pair) => pair,
        None => return Ok(false),
    };
    verify_p2pkh_inline_parsed(
        signature_bytes,
        pubkey_bytes,
        script_pubkey,
        flags,
        tx,
        input_index,
        height,
        network,
        precomputed_sighash_all,
        precomputed_p2pkh_hash,
        #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
        ecdsa_collect,
    )
}

/// Like [`verify_p2pkh_inline`] but skips a second `parse_p2pkh_script_sig` when the
/// caller already parsed (IBD serial / collect hot path).
#[cfg(feature = "production")]
#[inline]
pub fn verify_p2pkh_inline_parsed(
    signature_bytes: &[u8],
    pubkey_bytes: &[u8],
    script_pubkey: &[u8],
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    height: u64,
    network: crate::types::Network,
    precomputed_sighash_all: Option<[u8; 32]>,
    precomputed_p2pkh_hash: Option<[u8; 20]>,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collect: Option<(
        &crate::ecdsa_batch::EcdsaSignatureCollector,
        usize,
    )>,
) -> Result<bool> {
    #[cfg(feature = "profile")]
    let _t0 = std::time::Instant::now();

    let expected_hash = &script_pubkey[3..23];

    if (pubkey_bytes.len() != 33 && pubkey_bytes.len() != 65) || signature_bytes.is_empty() {
        return Ok(false);
    }

    #[cfg(feature = "profile")]
    let _t_hash = std::time::Instant::now();

    let pubkey_hash: [u8; 20] = match precomputed_p2pkh_hash {
        Some(h) => h,
        None => {
            let sha256_hash = OptimizedSha256::new().hash(pubkey_bytes);
            Ripemd160::digest(sha256_hash).into()
        }
    };
    if &pubkey_hash[..] != expected_hash {
        return Ok(false);
    }

    #[cfg(feature = "profile")]
    crate::script_profile::add_p2pkh_hash160_ns(_t_hash.elapsed().as_nanos() as u64);

    #[cfg(feature = "profile")]
    let _t_sighash = std::time::Instant::now();

    let sighash_byte = signature_bytes[signature_bytes.len() - 1];
    let sighash = if let Some(precomp) = precomputed_sighash_all {
        precomp
    } else {
        // Incremental hasher (REVERT calculate-path: S10 189.4 vs nocache 195.6).
        crate::transaction_hash::compute_legacy_sighash_nocache(
            tx,
            input_index,
            script_pubkey,
            sighash_byte,
        )
    };

    #[cfg(feature = "profile")]
    crate::script_profile::add_sighash_ns(_t_sighash.elapsed().as_nanos() as u64);

    let der_sig = &signature_bytes[..signature_bytes.len() - 1];
    let strict_der = flags & 0x04 != 0;
    let enforce_low_s = flags & 0x08 != 0;

    if strict_der
        && !crate::bip_validation::check_bip66_network(signature_bytes, height, network)
            .unwrap_or(false)
    {
        return Ok(false);
    }

    crate::script::signature::reject_strictenc(flags, sighash_byte, pubkey_bytes)?;

    #[cfg(feature = "profile")]
    let _t_secp = std::time::Instant::now();

    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
    if let Some((collector, global_idx)) = ecdsa_collect {
        // Defer secp to block-end batch (CPU / optional GPU). Need compressed pk + compact sig.
        let compact =
            match blvm_secp256k1::ecdsa::ecdsa_der_to_compact(der_sig, strict_der, enforce_low_s) {
                Some(c) => c,
                None => return Ok(false),
            };
        let pk33 = match pubkey_bytes.len() {
            33 => {
                let mut a = [0u8; 33];
                a.copy_from_slice(pubkey_bytes);
                a
            }
            65 => match blvm_secp256k1::ecdsa::ge_from_pubkey_bytes(pubkey_bytes) {
                Some(ge) => blvm_secp256k1::ecdsa::ge_to_compressed(&ge),
                None => return Ok(false),
            },
            _ => return Ok(false),
        };
        #[cfg(feature = "profile")]
        {
            crate::script_profile::add_p2pkh_collect_ns(_t_secp.elapsed().as_nanos() as u64);
            crate::script_profile::add_p2pkh_fast_path_entry_ns(_t0.elapsed().as_nanos() as u64);
        }
        collector.collect_with_index(global_idx, &sighash, &pk33, &compact);
        return Ok(true);
    }

    let result = crate::secp256k1_backend::verify_ecdsa_direct(
        der_sig,
        pubkey_bytes,
        &sighash,
        strict_der,
        enforce_low_s,
    )
    .unwrap_or(false);

    #[cfg(feature = "profile")]
    crate::script_profile::add_p2pkh_secp_context_ns(_t_secp.elapsed().as_nanos() as u64);

    #[cfg(feature = "profile")]
    crate::script_profile::add_p2pkh_fast_path_entry_ns(_t0.elapsed().as_nanos() as u64);

    Ok(result)
}

/// P2PK (Pay-to-Public-Key) inline verify.
#[cfg(feature = "production")]
#[inline]
pub fn verify_p2pk_inline(
    script_sig: &[u8],
    script_pubkey: &[u8],
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    height: u64,
    network: crate::types::Network,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collect: Option<(
        &crate::ecdsa_batch::EcdsaSignatureCollector,
        usize,
    )>,
) -> Result<bool> {
    let Some(pubkey_bytes) = canonical_p2pk_pubkey(script_pubkey) else {
        return Ok(false);
    };

    let signature_bytes = match parse_p2pk_script_sig(script_sig) {
        Some(s) => s,
        None => return Ok(false),
    };
    if signature_bytes.is_empty() {
        return Ok(false);
    }

    let sighash_byte = signature_bytes[signature_bytes.len() - 1];
    let script_code: &[u8] = script_pubkey; // P2PK scriptPubKey < 71 bytes, no FindAndDelete

    let sighash = crate::transaction_hash::compute_legacy_sighash_nocache(
        tx,
        input_index,
        script_code,
        sighash_byte,
    );

    let der_sig = &signature_bytes[..signature_bytes.len() - 1];
    let strict_der = flags & flags::SCRIPT_VERIFY_DERSIG != 0;
    let enforce_low_s = flags & flags::SCRIPT_VERIFY_LOW_S != 0;

    if strict_der
        && !crate::bip_validation::check_bip66_network(signature_bytes, height, network)
            .unwrap_or(false)
    {
        return Ok(false);
    }

    crate::script::signature::reject_strictenc(flags, sighash_byte, pubkey_bytes)?;

    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
    if let Some((collector, global_idx)) = ecdsa_collect {
        let compact =
            match blvm_secp256k1::ecdsa::ecdsa_der_to_compact(der_sig, strict_der, enforce_low_s) {
                Some(c) => c,
                None => return Ok(false),
            };
        let pk33 = match pubkey_bytes.len() {
            33 => {
                let mut a = [0u8; 33];
                a.copy_from_slice(pubkey_bytes);
                a
            }
            65 => match blvm_secp256k1::ecdsa::ge_from_pubkey_bytes(pubkey_bytes) {
                Some(ge) => blvm_secp256k1::ecdsa::ge_to_compressed(&ge),
                None => return Ok(false),
            },
            _ => return Ok(false),
        };
        collector.collect_with_index(global_idx, &sighash, &pk33, &compact);
        return Ok(true);
    }

    Ok(crate::secp256k1_backend::verify_ecdsa_direct(
        der_sig,
        pubkey_bytes,
        &sighash,
        strict_der,
        enforce_low_s,
    )
    .unwrap_or(false))
}

/// Null-fail applies after CHECKMULTISIG has failed, and then only if a signature is non-empty.
fn failed_multisig_nullfail(flags: u32, success: bool, any_nonempty_signature: bool) -> Result<()> {
    if !success && flags & flags::SCRIPT_VERIFY_NULLFAIL != 0 && any_nonempty_signature {
        return Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::SigNullFail,
            message: "OP_CHECKMULTISIG: non-null signature must not fail under NULLFAIL".into(),
        });
    }
    Ok(())
}

/// P2SH-multisig fast path: when redeem script matches `OP_m <pubkeys> OP_n OP_CHECKMULTISIG`,
/// verify inline or defer cartesian trials to [`EcdsaSignatureCollector`] when provided.
/// Returns Some(Ok(true/false)) if we handled it, None to fall through to interpreter.
#[allow(clippy::too_many_arguments)]
fn try_verify_p2sh_multisig_fast_path(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    network: crate::types::Network,
    #[cfg(feature = "production")] sighash_cache: Option<
        &crate::transaction_hash::SighashMidstateCache,
    >,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collector: Option<
        &crate::ecdsa_batch::EcdsaSignatureCollector,
    >,
) -> Option<Result<bool>> {
    let _ = prevout_script_pubkeys;
    // P2SH scriptPubKey: OP_HASH160 PUSH_20 <20> OP_EQUAL
    if script_pubkey.len() != 23
        || script_pubkey[0] != OP_HASH160
        || script_pubkey[1] != PUSH_20_BYTES
        || script_pubkey[22] != OP_EQUAL
    {
        return None;
    }
    let pushes = parse_borrowed_pushes(script_sig.as_ref())?;
    if pushes.len() < 2 {
        return None;
    }
    let redeem = pushes.last().expect("at least 2 pushes").as_ref();
    let expected_hash = &script_pubkey[2..22];
    let sha256_hash = OptimizedSha256::new().hash(redeem);
    let redeem_hash = Ripemd160::digest(sha256_hash);
    if &redeem_hash[..] != expected_hash {
        return Some(Ok(false));
    }
    let (m, _n, pubkeys) = parse_redeem_multisig(redeem)?;
    // The redeem is the last push. Items under it are the stack, bottom to top.
    let stack = &pushes[..pushes.len() - 1];
    let Some((dummy, signatures)) = checkmultisig_window(stack, m, false) else {
        return Some(Ok(false));
    };

    let height = block_height.unwrap_or(0);
    if (flags & flags::SCRIPT_VERIFY_NULLDUMMY) != 0 && !dummy.is_empty() {
        return Some(Ok(false));
    }

    let cleaned = multisig_script_code(redeem, &signatures);

    use crate::transaction_hash::{SighashType, calculate_transaction_sighash_single_input};

    // IBD deferral: cartesian oracle → SoA/GPU; Core match + NULLFAIL at block end.
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
    if let Some(collector) = ecdsa_collector {
        let nullfail = (flags & flags::SCRIPT_VERIFY_NULLFAIL) != 0;
        let enforce_low_s = (flags & flags::SCRIPT_VERIFY_LOW_S) != 0;
        let strict_der = (flags & flags::SCRIPT_VERIFY_DERSIG) != 0
            || (flags & flags::SCRIPT_VERIFY_STRICTENC) != 0
            || (flags & flags::SCRIPT_VERIFY_LOW_S) != 0;
        let mut trial_indices = Vec::new();
        let mut sig_empty = Vec::with_capacity(signatures.len());
        // Reuse sighash when multiple sigs share the same sighash byte (common m-of-n).
        let mut sighash_by_type: Vec<(u8, [u8; 32])> = Vec::new();
        for sig_bytes in &signatures {
            if sig_bytes.is_empty() {
                sig_empty.push(true);
                continue;
            }
            sig_empty.push(false);
            let sighash_byte = sig_bytes[sig_bytes.len() - 1];
            let sighash =
                if let Some((_, h)) = sighash_by_type.iter().find(|(b, _)| *b == sighash_byte) {
                    *h
                } else {
                    let sighash_type = SighashType::from_byte(sighash_byte);
                    let h = match calculate_transaction_sighash_single_input(
                        tx,
                        input_index,
                        &cleaned,
                        prevout_values[input_index],
                        sighash_type,
                        sighash_cache,
                    ) {
                        Ok(h) => h,
                        Err(e) => return Some(Err(e)),
                    };
                    sighash_by_type.push((sighash_byte, h));
                    h
                };
            let der_sig = &sig_bytes[..sig_bytes.len() - 1];
            // Invalid DER / high-S: Core treats the sig as non-matching, not hard-fail
            // (NULLFAIL applied at resolve when the overall match fails).
            let compact =
                blvm_secp256k1::ecdsa::ecdsa_der_to_compact(der_sig, strict_der, enforce_low_s);
            for pubkey_bytes in &pubkeys {
                let gidx = collector.alloc_multisig_trial_index();
                trial_indices.push(gidx);
                let Some(compact) = compact.as_ref() else {
                    // No SoA row → resolve sees false (unwrap_or(false)).
                    continue;
                };
                // Core skips invalid pubkeys (no match). Do not Ok(false) the spend —
                // mainnet 442715/tx1351 is 2-of-3 with one off-curve PUB65.
                let pk33 = match pubkey_bytes.len() {
                    33 => {
                        let mut a = [0u8; 33];
                        a.copy_from_slice(pubkey_bytes);
                        a
                    }
                    65 => match blvm_secp256k1::ecdsa::ge_from_pubkey_bytes(pubkey_bytes) {
                        Some(ge) => blvm_secp256k1::ecdsa::ge_to_compressed(&ge),
                        None => continue,
                    },
                    _ => continue,
                };
                collector.collect_with_index(gidx, &sighash, &pk33, compact);
            }
        }
        collector.push_multisig_pending(crate::ecdsa_batch::MultisigPending {
            m,
            n_pubs: pubkeys.len(),
            trial_indices,
            sig_empty,
            nullfail,
        });
        #[cfg(feature = "profile")]
        crate::script_profile::note_arm_p2sh_multisig(0);
        return Some(Ok(true));
    }

    let mut sig_index = 0;
    let mut valid_sigs = 0u8;

    for pubkey_bytes in pubkeys {
        if sig_index >= signatures.len() {
            break;
        }
        if signatures[sig_index].is_empty() {
            continue;
        }
        let signature_bytes = &signatures[sig_index];
        let sighash_byte = signature_bytes[signature_bytes.len() - 1];
        let sighash_type = SighashType::from_byte(sighash_byte);
        let sighash = match calculate_transaction_sighash_single_input(
            tx,
            input_index,
            &cleaned,
            prevout_values[input_index],
            sighash_type,
            #[cfg(feature = "production")]
            sighash_cache,
        ) {
            Ok(h) => h,
            Err(e) => return Some(Err(e)),
        };

        #[cfg(feature = "production")]
        let is_valid = signature::with_secp_context(|secp| {
            signature::verify_signature(
                secp,
                pubkey_bytes,
                signature_bytes,
                &sighash,
                flags,
                height,
                network,
                SigVersion::Base,
            )
        });

        #[cfg(not(feature = "production"))]
        let is_valid = {
            let secp = signature::new_secp();
            signature::verify_signature(
                &secp,
                pubkey_bytes,
                signature_bytes,
                &sighash,
                flags,
                height,
                network,
                SigVersion::Base,
            )
        };

        let is_valid = match is_valid {
            Ok(v) => v,
            Err(e) => return Some(Err(e)),
        };

        if is_valid {
            valid_sigs += 1;
            sig_index += 1;
        }
    }

    let success = signatures.len() == usize::from(m) && valid_sigs == m;
    if let Err(e) =
        failed_multisig_nullfail(flags, success, signatures.iter().any(|sig| !sig.is_empty()))
    {
        return Some(Err(e));
    }
    Some(Ok(success))
}

/// IBD entry: P2SH-multisig with optional SoA deferral (see [`try_verify_p2sh_multisig_fast_path`]).
#[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
#[allow(clippy::too_many_arguments)]
pub(crate) fn try_verify_p2sh_multisig_ibd(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    network: crate::types::Network,
    sighash_cache: Option<&crate::transaction_hash::SighashMidstateCache>,
    ecdsa_collector: Option<&crate::ecdsa_batch::EcdsaSignatureCollector>,
) -> Option<Result<bool>> {
    try_verify_p2sh_multisig_fast_path(
        script_sig,
        script_pubkey,
        flags,
        tx,
        input_index,
        prevout_values,
        prevout_script_pubkeys,
        block_height,
        network,
        sighash_cache,
        ecdsa_collector,
    )
}

/// Bare multisig fast path: scriptPubKey is `OP_m <pubkeys> OP_n OP_CHECKMULTISIG`.
/// scriptSig is bottom-to-top. The top `m` pushes are the signatures.
#[allow(clippy::too_many_arguments)]
fn try_verify_bare_multisig_fast_path(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    network: crate::types::Network,
    #[cfg(feature = "production")] sighash_cache: Option<
        &crate::transaction_hash::SighashMidstateCache,
    >,
) -> Option<Result<bool>> {
    let (m, _n, pubkeys) = parse_redeem_multisig(script_pubkey)?;
    let pushes = parse_borrowed_pushes(script_sig.as_ref())?;
    let Some((dummy, signatures)) = checkmultisig_window(&pushes, m, false) else {
        return Some(Ok(false));
    };

    let height = block_height.unwrap_or(0);
    if (flags & flags::SCRIPT_VERIFY_NULLDUMMY) != 0 && !dummy.is_empty() {
        return Some(Ok(false));
    }

    let cleaned = multisig_script_code(script_pubkey, &signatures);

    use crate::transaction_hash::{SighashType, calculate_transaction_sighash_single_input};

    let mut sig_index = 0;
    let mut valid_sigs = 0u8;

    for pubkey_bytes in pubkeys {
        if sig_index >= signatures.len() {
            break;
        }
        if signatures[sig_index].is_empty() {
            continue;
        }
        let signature_bytes = &signatures[sig_index];
        let sighash_byte = signature_bytes[signature_bytes.len() - 1];
        let sighash_type = SighashType::from_byte(sighash_byte);
        let sighash = match calculate_transaction_sighash_single_input(
            tx,
            input_index,
            &cleaned,
            prevout_values[input_index],
            sighash_type,
            #[cfg(feature = "production")]
            sighash_cache,
        ) {
            Ok(h) => h,
            Err(e) => return Some(Err(e)),
        };

        #[cfg(feature = "production")]
        let is_valid = signature::with_secp_context(|secp| {
            signature::verify_signature(
                secp,
                pubkey_bytes,
                signature_bytes,
                &sighash,
                flags,
                height,
                network,
                SigVersion::Base,
            )
        });

        #[cfg(not(feature = "production"))]
        let is_valid = {
            let secp = signature::new_secp();
            signature::verify_signature(
                &secp,
                pubkey_bytes,
                signature_bytes,
                &sighash,
                flags,
                height,
                network,
                SigVersion::Base,
            )
        };

        let is_valid = match is_valid {
            Ok(v) => v,
            Err(e) => return Some(Err(e)),
        };

        if is_valid {
            valid_sigs += 1;
            sig_index += 1;
        }
    }

    let success = signatures.len() == usize::from(m) && valid_sigs == m;
    if let Err(e) =
        failed_multisig_nullfail(flags, success, signatures.iter().any(|sig| !sig.is_empty()))
    {
        return Some(Err(e));
    }
    Some(Ok(success))
}

/// Verify a P2SH-P2PKH redeem from borrowed signature, pubkey, and redeem slices.
#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
fn verify_p2sh_p2pkh_redeem(
    signature_bytes: &[u8],
    pubkey_bytes: &[u8],
    redeem: &[u8],
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    block_height: Option<u64>,
    network: crate::types::Network,
    #[cfg(feature = "production")] sighash_cache: Option<
        &crate::transaction_hash::SighashMidstateCache,
    >,
    #[cfg(feature = "production")] precomputed_sighash_all: Option<[u8; 32]>,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collect: Option<(
        &crate::ecdsa_batch::EcdsaSignatureCollector,
        usize,
    )>,
) -> Result<bool> {
    #[cfg(feature = "production")]
    let sighash = if let Some(precomp) = precomputed_sighash_all {
        precomp
    } else {
        use crate::transaction_hash::{SighashType, calculate_transaction_sighash_single_input};
        let sighash_byte = signature_bytes[signature_bytes.len() - 1];
        let sighash_type = SighashType::from_byte(sighash_byte);
        let deleted_storage;
        let script_code: &[u8] = if redeem.len() < 71 {
            redeem
        } else {
            deleted_storage =
                with_push_pattern(signature_bytes, |pattern| find_and_delete(redeem, pattern));
            deleted_storage.as_ref()
        };
        calculate_transaction_sighash_single_input(
            tx,
            input_index,
            script_code,
            prevout_values[input_index],
            sighash_type,
            sighash_cache,
        )?
    };
    #[cfg(not(feature = "production"))]
    let sighash = {
        use crate::transaction_hash::{SighashType, calculate_transaction_sighash_single_input};
        let sighash_byte = signature_bytes[signature_bytes.len() - 1];
        let sighash_type = SighashType::from_byte(sighash_byte);
        let deleted_storage;
        let script_code: &[u8] = if redeem.len() < 71 {
            redeem
        } else {
            deleted_storage =
                with_push_pattern(signature_bytes, |pattern| find_and_delete(redeem, pattern));
            deleted_storage.as_ref()
        };
        calculate_transaction_sighash_single_input(
            tx,
            input_index,
            script_code,
            prevout_values[input_index],
            sighash_type,
        )?
    };
    let height = block_height.unwrap_or(0);
    let der_sig = &signature_bytes[..signature_bytes.len() - 1];
    let strict_der = flags & 0x04 != 0;
    let enforce_low_s = flags & 0x08 != 0;
    if strict_der
        && !crate::bip_validation::check_bip66_network(signature_bytes, height, network)
            .unwrap_or(false)
    {
        return Ok(false);
    }
    crate::script::signature::reject_strictenc(
        flags,
        signature_bytes[signature_bytes.len() - 1],
        pubkey_bytes,
    )?;
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
    if let Some((collector, global_idx)) = ecdsa_collect {
        // Default-on; set BLVM_P2SH_P2PKH_SOA=0 to disable.
        if std::env::var_os("BLVM_P2SH_P2PKH_SOA").is_none_or(|v| v != "0") {
            let compact = match blvm_secp256k1::ecdsa::ecdsa_der_to_compact(
                der_sig,
                strict_der,
                enforce_low_s,
            ) {
                Some(c) => c,
                None => return Ok(false),
            };
            let pk33 = match pubkey_bytes.len() {
                33 => {
                    let mut a = [0u8; 33];
                    a.copy_from_slice(pubkey_bytes);
                    a
                }
                65 => match blvm_secp256k1::ecdsa::ge_from_pubkey_bytes(pubkey_bytes) {
                    Some(ge) => blvm_secp256k1::ecdsa::ge_to_compressed(&ge),
                    None => return Ok(false),
                },
                _ => return Ok(false),
            };
            collector.collect_with_index(global_idx, &sighash, &pk33, &compact);
            return Ok(true);
        }
    }
    signature::with_secp_context(|secp| {
        signature::verify_signature(
            secp,
            pubkey_bytes,
            signature_bytes,
            &sighash,
            flags,
            height,
            network,
            SigVersion::Base,
        )
    })
}

/// Verify a P2SH-P2PK redeem from a borrowed signature and redeem script.
#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
fn verify_p2sh_p2pk_redeem(
    signature_bytes: &[u8],
    pubkey_bytes: &[u8],
    redeem: &[u8],
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    block_height: Option<u64>,
    network: crate::types::Network,
    #[cfg(feature = "production")] sighash_cache: Option<
        &crate::transaction_hash::SighashMidstateCache,
    >,
) -> Result<bool> {
    use crate::transaction_hash::{SighashType, calculate_transaction_sighash_single_input};
    let sighash_byte = signature_bytes[signature_bytes.len() - 1];
    let sighash_type = SighashType::from_byte(sighash_byte);
    // Redeem is 35 or 67 bytes. A signature push is at least 71, so FindAndDelete cannot match.
    let deleted_storage;
    let script_code: &[u8] = if redeem.len() < 71 {
        redeem
    } else {
        deleted_storage =
            with_push_pattern(signature_bytes, |pattern| find_and_delete(redeem, pattern));
        deleted_storage.as_ref()
    };
    let sighash = calculate_transaction_sighash_single_input(
        tx,
        input_index,
        script_code,
        prevout_values[input_index],
        sighash_type,
        #[cfg(feature = "production")]
        sighash_cache,
    )?;
    let height = block_height.unwrap_or(0);
    signature::with_secp_context(|secp| {
        signature::verify_signature(
            secp,
            pubkey_bytes,
            signature_bytes,
            &sighash,
            flags,
            height,
            network,
            SigVersion::Base,
        )
    })
}

/// P2SH fast-path for regular P2SH (redeem script is not a witness program).
/// Skips scriptSig + scriptPubKey interpreter run; verifies hash then runs redeem script only.
/// Returns None to fall back to full interpreter (e.g. witness programs, non-P2SH).
#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
fn try_verify_p2sh_fast_path(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    median_time_past: Option<u64>,
    network: crate::types::Network,
    #[cfg(feature = "production")] sighash_cache: Option<
        &crate::transaction_hash::SighashMidstateCache,
    >,
    #[cfg(feature = "production")] precomputed_sighash_all: Option<[u8; 32]>,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collect: Option<(
        &crate::ecdsa_batch::EcdsaSignatureCollector,
        usize,
    )>,
) -> Option<Result<bool>> {
    if (flags & flags::SCRIPT_VERIFY_P2SH) == 0 {
        return None;
    }
    // P2SH scriptPubKey: 23 bytes = OP_HASH160 PUSH_20_BYTES <20 bytes> OP_EQUAL
    if script_pubkey.len() != 23
        || script_pubkey[0] != OP_HASH160
        || script_pubkey[1] != PUSH_20_BYTES
        || script_pubkey[22] != OP_EQUAL
    {
        return None;
    }
    let expected_hash = &script_pubkey[2..22];

    // P2SH-P2PKH is three data pushes. Borrow them. The owned parse below is for
    // numeric pushes and redeems that still run the interpreter.
    if let Some((signature_bytes, pubkey_bytes, redeem)) =
        parse_p2sh_p2pkh_pushes(script_sig.as_ref())
    {
        let redeem_sha = OptimizedSha256::new().hash(redeem);
        let redeem_hash = Ripemd160::digest(redeem_sha);
        if &redeem_hash[..] != expected_hash {
            return Some(Ok(false));
        }
        if pubkey_bytes.len() == 33 || pubkey_bytes.len() == 65 {
            let pubkey_sha = OptimizedSha256::new().hash(pubkey_bytes);
            let pubkey_hash = Ripemd160::digest(pubkey_sha);
            if pubkey_hash[..] == redeem[3..23] {
                return Some(verify_p2sh_p2pkh_redeem(
                    signature_bytes,
                    pubkey_bytes,
                    redeem,
                    flags,
                    tx,
                    input_index,
                    prevout_values,
                    block_height,
                    network,
                    #[cfg(feature = "production")]
                    sighash_cache,
                    #[cfg(feature = "production")]
                    precomputed_sighash_all,
                    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
                    ecdsa_collect,
                ));
            }
        }
    }

    // P2SH-P2PK is a signature push plus a 35-byte or 67-byte redeem.
    if let Some((signature_bytes, pubkey_bytes, redeem)) =
        parse_p2sh_p2pk_pushes(script_sig.as_ref())
    {
        let redeem_sha = OptimizedSha256::new().hash(redeem);
        let redeem_hash = Ripemd160::digest(redeem_sha);
        if &redeem_hash[..] != expected_hash {
            return Some(Ok(false));
        }
        return Some(verify_p2sh_p2pk_redeem(
            signature_bytes,
            pubkey_bytes,
            redeem,
            flags,
            tx,
            input_index,
            prevout_values,
            block_height,
            network,
            #[cfg(feature = "production")]
            sighash_cache,
        ));
    }

    // The redeem is the last push and is only used as script bytes. The items
    // under it are copied because the interpreter pops them.
    let pushes = parse_borrowed_pushes(script_sig.as_ref())?;
    if pushes.is_empty() {
        return None;
    }
    let redeem = pushes.last().expect("at least one push").as_ref();
    let mut stack: Vec<StackElement> = pushes[..pushes.len() - 1]
        .iter()
        .map(|push| to_stack_element(push.as_ref()))
        .collect();

    // Any witness-program redeem, including a future version. The interpreter
    // checks the hash, the canonical push, and that the program bytes are a
    // true stack value. Executing the redeem here would report success for a
    // base script without that check.
    if crate::witness::is_any_witness_program(redeem) {
        return None;
    }

    // HASH160(redeem) == expected hash
    let sha256_hash = OptimizedSha256::new().hash(redeem.as_ref());
    let redeem_hash = Ripemd160::digest(sha256_hash);
    if &redeem_hash[..] != expected_hash {
        return Some(Ok(false));
    }

    // P2SH-with-P2PKH-redeem fast-path: skip interpreter when redeem is P2PKH
    if redeem.len() == 25
        && redeem[0] == OP_DUP
        && redeem[1] == OP_HASH160
        && redeem[2] == PUSH_20_BYTES
        && redeem[23] == OP_EQUALVERIFY
        && redeem[24] == OP_CHECKSIG
        && stack.len() == 2
    {
        let signature_bytes = &stack[0];
        let pubkey_bytes = &stack[1];
        if (pubkey_bytes.len() == 33 || pubkey_bytes.len() == 65) && !signature_bytes.is_empty() {
            let expected_pubkey_hash = &redeem[3..23];
            let sha256_hash = OptimizedSha256::new().hash(pubkey_bytes);
            let pubkey_hash = Ripemd160::digest(sha256_hash);
            if &pubkey_hash[..] == expected_pubkey_hash {
                return Some(verify_p2sh_p2pkh_redeem(
                    signature_bytes,
                    pubkey_bytes,
                    redeem,
                    flags,
                    tx,
                    input_index,
                    prevout_values,
                    block_height,
                    network,
                    #[cfg(feature = "production")]
                    sighash_cache,
                    #[cfg(feature = "production")]
                    precomputed_sighash_all,
                    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
                    ecdsa_collect,
                ));
            }
        }
    }

    // P2SH-with-P2PK-redeem fast-path: redeem = push(pubkey) OP_CHECKSIG, stack = [sig]
    if stack.len() == 1 {
        if let Some(pubkey_bytes) = canonical_p2pk_pubkey(redeem) {
            let signature_bytes = &stack[0];
            if !signature_bytes.is_empty() {
                return Some(verify_p2sh_p2pk_redeem(
                    signature_bytes,
                    pubkey_bytes,
                    redeem,
                    flags,
                    tx,
                    input_index,
                    prevout_values,
                    block_height,
                    network,
                    #[cfg(feature = "production")]
                    sighash_cache,
                ));
            }
        }
    }

    // Execute redeem script with remaining stack (same as regular P2SH path: no batch collector)
    let result = eval_script_with_context_full_inner(
        redeem,
        &mut stack,
        flags,
        tx,
        input_index,
        prevout_values,
        prevout_script_pubkeys,
        block_height,
        median_time_past,
        network,
        SigVersion::Base,
        Some(redeem),
        Some(script_sig), // FindAndDelete uses the same scriptSig as the slow path
        None,             // taproot_annex_hash
        None,             // tapscript_validation_weight
        #[cfg(feature = "production")]
        None, // schnorr_collector
        None,             // precomputed_bip143 - Base sigversion
        #[cfg(feature = "production")]
        sighash_cache,
    );
    // Base eval returns Ok(true) without looking at the stack. VerifyScript
    // still requires a truthy top, so a redeem of OP_0 fails. A clean stack
    // is one truthy item, and only when that policy flag is set.
    let result = match result {
        Ok(true) => {
            let top_true = !stack.is_empty() && cast_to_bool(stack.last().expect("redeem stack"));
            let ok = if flags & flags::SCRIPT_VERIFY_CLEANSTACK != 0 {
                stack.len() == 1 && top_true
            } else {
                top_true
            };
            Ok(ok)
        }
        other => other,
    };
    Some(result)
}

/// DER, BIP66, strict encoding, optional SoA collect, then witness-v0 ECDSA.
///
/// Default-on SoA collect; set `BLVM_P2WPKH_SOA=0` to disable. A deferred GPU
/// path false-rejected mainnet block 497110 tx 330, so the env gate stays.
#[cfg(feature = "production")]
fn finish_p2wpkh_ecdsa(
    signature_bytes: &[u8],
    pubkey_bytes: &[u8],
    sighash: &[u8; 32],
    flags: u32,
    height: u64,
    network: crate::types::Network,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collect: Option<(
        &crate::ecdsa_batch::EcdsaSignatureCollector,
        usize,
    )>,
) -> Result<bool> {
    let der_sig = &signature_bytes[..signature_bytes.len() - 1];
    let strict_der = flags & 0x04 != 0;
    let enforce_low_s = flags & 0x08 != 0;
    let sighash_byte = signature_bytes[signature_bytes.len() - 1];

    if strict_der
        && !crate::bip_validation::check_bip66_network(signature_bytes, height, network)
            .unwrap_or(false)
    {
        return Ok(false);
    }

    crate::script::signature::reject_strictenc(flags, sighash_byte, pubkey_bytes)?;

    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
    if let Some((collector, global_idx)) = ecdsa_collect {
        if std::env::var_os("BLVM_P2WPKH_SOA").is_none_or(|v| v != "0") {
            let compact = match blvm_secp256k1::ecdsa::ecdsa_der_to_compact(
                der_sig,
                strict_der,
                enforce_low_s,
            ) {
                Some(c) => c,
                None => return Ok(false),
            };
            let pk33 = match pubkey_bytes.len() {
                33 => {
                    let mut a = [0u8; 33];
                    a.copy_from_slice(pubkey_bytes);
                    a
                }
                65 => match blvm_secp256k1::ecdsa::ge_from_pubkey_bytes(pubkey_bytes) {
                    Some(ge) => blvm_secp256k1::ecdsa::ge_to_compressed(&ge),
                    None => return Ok(false),
                },
                _ => return Ok(false),
            };
            collector.collect_with_index(global_idx, sighash, &pk33, &compact);
            return Ok(true);
        }
    }

    Ok(signature::with_secp_context(|secp| {
        signature::verify_signature(
            secp,
            pubkey_bytes,
            signature_bytes,
            sighash,
            flags,
            height,
            network,
            SigVersion::WitnessV0,
        )
    })
    .unwrap_or(false))
}

/// Native P2WPKH inline verify (BIP143). Caller must gate scriptPubKey / witness shape.
#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
#[inline]
pub fn verify_p2wpkh_inline(
    witness: &crate::witness::Witness,
    script_pubkey: &[u8],
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_value: i64,
    height: u64,
    network: crate::types::Network,
    precomputed_bip143: Option<&crate::transaction_hash::Bip143PrecomputedHashes>,
    precomputed_sighash_all: Option<[u8; 32]>,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collect: Option<(
        &crate::ecdsa_batch::EcdsaSignatureCollector,
        usize,
    )>,
) -> Result<bool> {
    let signature_bytes = &witness[0];
    let pubkey_bytes = &witness[1];
    if (pubkey_bytes.len() != 33 && pubkey_bytes.len() != 65) || signature_bytes.is_empty() {
        return Ok(false);
    }

    let expected_hash = &script_pubkey[2..22];
    let sha256_hash = OptimizedSha256::new().hash(pubkey_bytes);
    let pubkey_hash = Ripemd160::digest(sha256_hash);
    if &pubkey_hash[..] != expected_hash {
        return Ok(false);
    }

    let p2pkh_script_code = bip143_p2wpkh_script_code(expected_hash);
    let sighash_byte = signature_bytes[signature_bytes.len() - 1];
    let sighash = if sighash_byte == 0x01 {
        if let Some(precomp) = precomputed_sighash_all {
            precomp
        } else {
            crate::transaction_hash::calculate_bip143_sighash(
                tx,
                input_index,
                &p2pkh_script_code,
                prevout_value,
                sighash_byte,
                precomputed_bip143,
            )?
        }
    } else {
        crate::transaction_hash::calculate_bip143_sighash(
            tx,
            input_index,
            &p2pkh_script_code,
            prevout_value,
            sighash_byte,
            precomputed_bip143,
        )?
    };

    finish_p2wpkh_ecdsa(
        signature_bytes,
        pubkey_bytes,
        &sighash,
        flags,
        height,
        network,
        #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
        ecdsa_collect,
    )
}

/// The script is one data push. Numeric opcodes are not this pattern.
#[cfg(feature = "production")]
#[inline(always)]
fn single_data_push(script: &[u8]) -> Option<&[u8]> {
    let (advance, start, end) = parse_one_data_push(script, 0)?;
    if advance != script.len() {
        return None;
    }
    Some(&script[start..end])
}

/// P2WPKH-in-P2SH inline verify (BIP143). Caller must gate scriptPubKey / scriptSig / witness shape.
#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
#[inline]
pub fn verify_p2wpkh_in_p2sh_inline(
    script_sig: &[u8],
    witness: &crate::witness::Witness,
    script_pubkey: &[u8],
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_value: i64,
    height: u64,
    network: crate::types::Network,
    precomputed_bip143: Option<&crate::transaction_hash::Bip143PrecomputedHashes>,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collect: Option<(
        &crate::ecdsa_batch::EcdsaSignatureCollector,
        usize,
    )>,
) -> Result<bool> {
    let expected_hash = &script_pubkey[2..22];
    let Some(redeem) = single_data_push(script_sig) else {
        return Ok(false);
    };
    if redeem.len() != 22 || redeem[0] != OP_0 || redeem[1] != PUSH_20_BYTES {
        return Ok(false);
    }
    if !redeem_push_is_canonical(script_sig, redeem) {
        return Ok(false);
    }
    let sha256_hash = OptimizedSha256::new().hash(redeem.as_ref());
    let redeem_hash = Ripemd160::digest(sha256_hash);
    if &redeem_hash[..] != expected_hash {
        return Ok(false);
    }

    if witness.len() != 2 {
        return Ok(false);
    }
    let signature_bytes = &witness[0];
    let pubkey_bytes = &witness[1];
    if (pubkey_bytes.len() != 33 && pubkey_bytes.len() != 65) || signature_bytes.is_empty() {
        return Ok(false);
    }
    let expected_pubkey_hash = &redeem[2..22];
    let pubkey_sha256 = OptimizedSha256::new().hash(pubkey_bytes);
    let pubkey_hash = Ripemd160::digest(pubkey_sha256);
    if &pubkey_hash[..] != expected_pubkey_hash {
        return Ok(false);
    }

    let p2pkh_script_code = bip143_p2wpkh_script_code(expected_pubkey_hash);
    let sighash_byte = signature_bytes[signature_bytes.len() - 1];
    let sighash = crate::transaction_hash::calculate_bip143_sighash(
        tx,
        input_index,
        &p2pkh_script_code,
        prevout_value,
        sighash_byte,
        precomputed_bip143,
    )?;

    finish_p2wpkh_ecdsa(
        signature_bytes,
        pubkey_bytes,
        &sighash,
        flags,
        height,
        network,
        #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
        ecdsa_collect,
    )
}

/// P2WPKH fast-path (SegWit P2PKH). ScriptPubKey OP_0 <20-byte-hash>, witness [sig, pubkey].
/// Uses BIP143 sighash; skips interpreter. Returns None to fall back to full path.
#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
fn try_verify_p2wpkh_fast_path(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    witness: &crate::witness::Witness,
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    network: crate::types::Network,
    precomputed_bip143: Option<&crate::transaction_hash::Bip143PrecomputedHashes>,
    #[cfg(feature = "production")] precomputed_sighash_all: Option<[u8; 32]>,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collect: Option<(
        &crate::ecdsa_batch::EcdsaSignatureCollector,
        usize,
    )>,
) -> Option<Result<bool>> {
    let _ = prevout_script_pubkeys;
    if flags & crate::script::flags::SCRIPT_VERIFY_WITNESS == 0 {
        return None;
    }
    // P2WPKH: 22 bytes = OP_0 PUSH_20_BYTES <20-byte-hash>
    if script_pubkey.len() != 22 || script_pubkey[0] != OP_0 || script_pubkey[1] != PUSH_20_BYTES {
        return None;
    }
    // Native SegWit: scriptSig must be empty
    if !script_sig.is_empty() {
        return None;
    }
    if witness.len() != 2 {
        return None;
    }
    let height = block_height.unwrap_or(0);
    let prevout_value = prevout_values.get(input_index).copied().unwrap_or(0);
    Some(verify_p2wpkh_inline(
        witness,
        script_pubkey,
        flags,
        tx,
        input_index,
        prevout_value,
        height,
        network,
        precomputed_bip143,
        precomputed_sighash_all,
        #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
        ecdsa_collect,
    ))
}

/// P2WPKH-in-P2SH (nested SegWit). ScriptPubKey P2SH, scriptSig = \[redeem\], redeem = OP_0 + 20-byte pubkey hash, witness = \[sig, pubkey\].
#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
fn try_verify_p2wpkh_in_p2sh_fast_path(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    witness: &crate::witness::Witness,
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    network: crate::types::Network,
    precomputed_bip143: Option<&crate::transaction_hash::Bip143PrecomputedHashes>,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collect: Option<(
        &crate::ecdsa_batch::EcdsaSignatureCollector,
        usize,
    )>,
) -> Option<Result<bool>> {
    let _ = prevout_script_pubkeys;
    if flags & crate::script::flags::SCRIPT_VERIFY_WITNESS == 0 {
        return None;
    }
    if (flags & flags::SCRIPT_VERIFY_P2SH) == 0 {
        return None;
    }
    if script_pubkey.len() != 23
        || script_pubkey[0] != OP_HASH160
        || script_pubkey[1] != PUSH_20_BYTES
        || script_pubkey[22] != OP_EQUAL
    {
        return None;
    }
    // P2WSH-in-P2SH also commonly has witness.len()==2 ([sig…, witnessScript]).
    // Only claim nested P2WPKH when redeem is the 22-byte v0 program; otherwise None
    // so the full P2SH/witness path runs (mainnet fail @497110 tx330 without this gate).
    if witness.len() != 2 {
        return None;
    }
    let redeem = single_data_push(script_sig.as_ref())?;
    if redeem.len() != 22 || redeem[0] != OP_0 || redeem[1] != PUSH_20_BYTES {
        return None;
    }
    if !redeem_push_is_canonical(script_sig.as_ref(), redeem) {
        return Some(Ok(false));
    }
    let height = block_height.unwrap_or(0);
    let prevout_value = prevout_values.get(input_index).copied().unwrap_or(0);
    Some(verify_p2wpkh_in_p2sh_inline(
        script_sig.as_ref(),
        witness,
        script_pubkey,
        flags,
        tx,
        input_index,
        prevout_value,
        height,
        network,
        precomputed_bip143,
        #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
        ecdsa_collect,
    ))
}

/// One CHECKSIG in a witness script joins the block batch at `global_idx`.
/// `None` means the caller should verify inline (`BLVM_P2WPKH_SOA=0`).
#[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
fn try_collect_witness_ecdsa(
    collector: &crate::ecdsa_batch::EcdsaSignatureCollector,
    global_idx: usize,
    signature_bytes: &[u8],
    pubkey_bytes: &[u8],
    sighash: &[u8; 32],
    flags: u32,
    height: u64,
    network: crate::types::Network,
) -> Option<Result<bool>> {
    if std::env::var_os("BLVM_P2WPKH_SOA").is_some_and(|v| v == "0") {
        return None;
    }
    let der_sig = &signature_bytes[..signature_bytes.len() - 1];
    let strict_der = flags & 0x04 != 0;
    let enforce_low_s = flags & 0x08 != 0;
    if strict_der
        && !crate::bip_validation::check_bip66_network(signature_bytes, height, network)
            .unwrap_or(false)
    {
        return Some(Ok(false));
    }
    if let Err(err) = crate::script::signature::reject_strictenc(
        flags,
        signature_bytes[signature_bytes.len() - 1],
        pubkey_bytes,
    ) {
        return Some(Err(err));
    }
    let compact =
        match blvm_secp256k1::ecdsa::ecdsa_der_to_compact(der_sig, strict_der, enforce_low_s) {
            Some(c) => c,
            None => return Some(Ok(false)),
        };
    let pk33 = match pubkey_bytes.len() {
        33 => {
            let mut a = [0u8; 33];
            a.copy_from_slice(pubkey_bytes);
            a
        }
        65 => match blvm_secp256k1::ecdsa::ge_from_pubkey_bytes(pubkey_bytes) {
            Some(ge) => blvm_secp256k1::ecdsa::ge_to_compressed(&ge),
            None => return Some(Ok(false)),
        },
        _ => return Some(Ok(false)),
    };
    collector.collect_with_index(global_idx, sighash, &pk33, &compact);
    Some(Ok(true))
}

/// P2WSH-in-P2SH (nested). scriptSig = \[redeem\], redeem = OP_0 + 32-byte program; then same as native P2WSH.
/// Must run after nested-P2WPKH gate so 22-byte redeems are not claimed here.
#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
pub(crate) fn try_verify_p2wsh_in_p2sh_fast_path(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    witness: &crate::witness::Witness,
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    median_time_past: Option<u64>,
    network: crate::types::Network,
    schnorr_collector: Option<&crate::bip348::SchnorrSignatureCollector>,
    precomputed_bip143: Option<&crate::transaction_hash::Bip143PrecomputedHashes>,
    #[cfg(feature = "production")] sighash_cache: Option<
        &crate::transaction_hash::SighashMidstateCache,
    >,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collect: Option<(
        &crate::ecdsa_batch::EcdsaSignatureCollector,
        usize,
    )>,
) -> Option<Result<bool>> {
    if flags & crate::script::flags::SCRIPT_VERIFY_WITNESS == 0 {
        return None;
    }
    if (flags & flags::SCRIPT_VERIFY_P2SH) == 0 {
        return None;
    }
    if script_pubkey.len() != 23
        || script_pubkey[0] != OP_HASH160
        || script_pubkey[1] != PUSH_20_BYTES
        || script_pubkey[22] != OP_EQUAL
    {
        return None;
    }
    let redeem = single_data_push(script_sig.as_ref())?;
    if redeem.len() != 34 || redeem[0] != OP_0 || redeem[1] != PUSH_32_BYTES {
        return None;
    }
    if !redeem_push_is_canonical(script_sig.as_ref(), redeem) {
        return Some(Ok(false));
    }
    let expected_hash = &script_pubkey[2..22];
    let sha256_hash = OptimizedSha256::new().hash(redeem.as_ref());
    let redeem_hash = Ripemd160::digest(sha256_hash);
    if &redeem_hash[..] != expected_hash {
        return Some(Ok(false));
    }
    // Native P2WSH path with an empty scriptSig and the redeem script as the v0 program.
    try_verify_p2wsh_fast_path(
        &[],
        redeem,
        witness,
        flags,
        tx,
        input_index,
        prevout_values,
        prevout_script_pubkeys,
        block_height,
        median_time_past,
        network,
        schnorr_collector,
        precomputed_bip143,
        #[cfg(feature = "production")]
        sighash_cache,
        #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
        ecdsa_collect,
    )
}

/// P2WSH fast-path. ScriptPubKey OP_0 <32-byte-SHA256(witness_script)>; witness = [..., witness_script].
/// Verifies hash then executes witness script only. Returns None to fall back to full path.
#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
pub(crate) fn try_verify_p2wsh_fast_path(
    script_sig: &[u8],
    script_pubkey: &[u8],
    witness: &crate::witness::Witness,
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    median_time_past: Option<u64>,
    network: crate::types::Network,
    schnorr_collector: Option<&crate::bip348::SchnorrSignatureCollector>,
    precomputed_bip143: Option<&crate::transaction_hash::Bip143PrecomputedHashes>,
    #[cfg(feature = "production")] sighash_cache: Option<
        &crate::transaction_hash::SighashMidstateCache,
    >,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collect: Option<(
        &crate::ecdsa_batch::EcdsaSignatureCollector,
        usize,
    )>,
) -> Option<Result<bool>> {
    if flags & crate::script::flags::SCRIPT_VERIFY_WITNESS == 0 {
        return None;
    }
    // P2WSH: 34 bytes = OP_0 PUSH_32_BYTES <32-byte-hash>
    if script_pubkey.len() != 34 || script_pubkey[0] != OP_0 || script_pubkey[1] != PUSH_32_BYTES {
        return None;
    }
    if !script_sig.is_empty() {
        return None;
    }
    if witness.is_empty() {
        return None;
    }
    let max_witness_elem = MAX_SCRIPT_ELEMENT_SIZE;
    for element in witness.iter().take(witness.len().saturating_sub(1)) {
        if element.len() > max_witness_elem {
            return Some(Ok(false));
        }
    }
    // Borrow the witness script. A hash mismatch rejects before any stack copy.
    let witness_script: &[u8] = witness.last().expect("witness not empty").as_ref();
    let program_hash = &script_pubkey[2..34];
    let witness_script_hash = OptimizedSha256::new().hash(witness_script);
    if &witness_script_hash[..] != program_hash {
        return Some(Ok(false));
    }

    // P2WSH always uses WitnessV0 sighash semantics (BIP143).
    // 0x8000 is SCRIPT_VERIFY_WITNESS_PUBKEYTYPE — a key-type strictness flag, not a
    // sigversion selector. Tapscript only applies inside Taproot script-path spends.
    let witness_sigversion = SigVersion::WitnessV0;

    // P2WSH-with-P2PKH fast-path: witness_script = P2PKH, stack = [sig, pubkey]. BIP143 inline verify.
    if witness_sigversion == SigVersion::WitnessV0
        && witness_script.len() == 25
        && witness_script[0] == OP_DUP
        && witness_script[1] == OP_HASH160
        && witness_script[2] == PUSH_20_BYTES
        && witness_script[23] == OP_EQUALVERIFY
        && witness_script[24] == OP_CHECKSIG
        && witness.len() == 3
    {
        let signature_bytes: &[u8] = witness[0].as_ref();
        let pubkey_bytes: &[u8] = witness[1].as_ref();
        if (pubkey_bytes.len() == 33 || pubkey_bytes.len() == 65) && !signature_bytes.is_empty() {
            let expected_pubkey_hash = &witness_script[3..23];
            let pubkey_sha256 = OptimizedSha256::new().hash(pubkey_bytes);
            let pubkey_hash = Ripemd160::digest(pubkey_sha256);
            if &pubkey_hash[..] == expected_pubkey_hash {
                let sighash_byte = signature_bytes[signature_bytes.len() - 1];
                let amount = prevout_values.get(input_index).copied().unwrap_or(0);
                match crate::transaction_hash::calculate_bip143_sighash(
                    tx,
                    input_index,
                    witness_script,
                    amount,
                    sighash_byte,
                    precomputed_bip143,
                ) {
                    Ok(sighash) => {
                        let height = block_height.unwrap_or(0);
                        #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
                        if let Some((collector, global_idx)) = ecdsa_collect {
                            if let Some(verdict) = try_collect_witness_ecdsa(
                                collector,
                                global_idx,
                                signature_bytes,
                                pubkey_bytes,
                                &sighash,
                                flags,
                                height,
                                network,
                            ) {
                                return Some(verdict);
                            }
                        }
                        let is_valid = signature::with_secp_context(|secp| {
                            signature::verify_signature(
                                secp,
                                pubkey_bytes,
                                signature_bytes,
                                &sighash,
                                flags,
                                height,
                                network,
                                SigVersion::WitnessV0,
                            )
                        });
                        return Some(is_valid);
                    }
                    Err(e) => return Some(Err(e)),
                }
            }
        }
    }

    // P2WSH-with-P2PK fast-path: witness_script = push(pubkey) OP_CHECKSIG, stack = [sig]. BIP143 inline verify.
    if witness_sigversion == SigVersion::WitnessV0 && witness.len() == 2 {
        if let Some(pubkey_bytes) = canonical_p2pk_pubkey(witness_script) {
            let signature_bytes: &[u8] = witness[0].as_ref();
            if !signature_bytes.is_empty() {
                let sighash_byte = signature_bytes[signature_bytes.len() - 1];
                let amount = prevout_values.get(input_index).copied().unwrap_or(0);
                match crate::transaction_hash::calculate_bip143_sighash(
                    tx,
                    input_index,
                    witness_script,
                    amount,
                    sighash_byte,
                    precomputed_bip143,
                ) {
                    Ok(sighash) => {
                        let height = block_height.unwrap_or(0);
                        #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
                        if let Some((collector, global_idx)) = ecdsa_collect {
                            if let Some(verdict) = try_collect_witness_ecdsa(
                                collector,
                                global_idx,
                                signature_bytes,
                                pubkey_bytes,
                                &sighash,
                                flags,
                                height,
                                network,
                            ) {
                                return Some(verdict);
                            }
                        }
                        let is_valid = signature::with_secp_context(|secp| {
                            signature::verify_signature(
                                secp,
                                pubkey_bytes,
                                signature_bytes,
                                &sighash,
                                flags,
                                height,
                                network,
                                SigVersion::WitnessV0,
                            )
                        });
                        return Some(is_valid);
                    }
                    Err(e) => return Some(Err(e)),
                }
            }
        }
    }

    // P2WSH multisig: witness script is `OP_m <pubkeys> OP_n OP_CHECKMULTISIG`.
    // The stack under the script must be exactly the dummy plus `m` signatures.
    // Those items are borrowed from the witness. The interpreter copy is below.
    if witness_sigversion == SigVersion::WitnessV0 {
        if let Some((m, _n, pubkeys)) = parse_redeem_multisig(witness_script) {
            let items = &witness[..witness.len() - 1];
            let Some((dummy, signatures)) = checkmultisig_window(items, m, true) else {
                return Some(Ok(false));
            };

            let height = block_height.unwrap_or(0);
            if (flags & flags::SCRIPT_VERIFY_NULLDUMMY) != 0 && !dummy.is_empty() {
                return Some(Ok(false));
            }

            // WitnessV0 (BIP143): scriptCode is the witness script; no FindAndDelete.
            let script_code = witness_script;
            let amount = prevout_values.get(input_index).copied().unwrap_or(0);

            // IBD deferral: cartesian oracle → SoA/GPU; Core match + NULLFAIL at block end.
            #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
            if let Some((collector, _)) = ecdsa_collect {
                let nullfail = (flags & flags::SCRIPT_VERIFY_NULLFAIL) != 0;
                let enforce_low_s = (flags & flags::SCRIPT_VERIFY_LOW_S) != 0;
                let strict_der = (flags & flags::SCRIPT_VERIFY_DERSIG) != 0
                    || (flags & flags::SCRIPT_VERIFY_STRICTENC) != 0
                    || (flags & flags::SCRIPT_VERIFY_LOW_S) != 0;
                let mut trial_indices = Vec::new();
                let mut sig_empty = Vec::with_capacity(signatures.len());
                // Reuse BIP143 sighash when multiple sigs share sighash byte (common m-of-n).
                let mut sighash_by_type: Vec<(u8, [u8; 32])> = Vec::new();
                for sig_bytes in &signatures {
                    if sig_bytes.is_empty() {
                        sig_empty.push(true);
                        continue;
                    }
                    sig_empty.push(false);
                    let sighash_byte = sig_bytes[sig_bytes.len() - 1];
                    let sighash = if let Some((_, h)) =
                        sighash_by_type.iter().find(|(b, _)| *b == sighash_byte)
                    {
                        *h
                    } else {
                        let h = match crate::transaction_hash::calculate_bip143_sighash(
                            tx,
                            input_index,
                            script_code,
                            amount,
                            sighash_byte,
                            precomputed_bip143,
                        ) {
                            Ok(h) => h,
                            Err(e) => return Some(Err(e)),
                        };
                        sighash_by_type.push((sighash_byte, h));
                        h
                    };
                    let der_sig = &sig_bytes[..sig_bytes.len() - 1];
                    let compact = blvm_secp256k1::ecdsa::ecdsa_der_to_compact(
                        der_sig,
                        strict_der,
                        enforce_low_s,
                    );
                    for pubkey_bytes in &pubkeys {
                        let gidx = collector.alloc_multisig_trial_index();
                        trial_indices.push(gidx);
                        let Some(compact) = compact.as_ref() else {
                            continue;
                        };
                        let pk33 = match pubkey_bytes.len() {
                            33 => {
                                let mut a = [0u8; 33];
                                a.copy_from_slice(pubkey_bytes);
                                a
                            }
                            65 => match blvm_secp256k1::ecdsa::ge_from_pubkey_bytes(pubkey_bytes) {
                                Some(ge) => blvm_secp256k1::ecdsa::ge_to_compressed(&ge),
                                None => continue,
                            },
                            _ => continue,
                        };
                        collector.collect_with_index(gidx, &sighash, &pk33, compact);
                    }
                }
                collector.push_multisig_pending(crate::ecdsa_batch::MultisigPending {
                    m,
                    n_pubs: pubkeys.len(),
                    trial_indices,
                    sig_empty,
                    nullfail,
                });
                #[cfg(feature = "profile")]
                crate::script_profile::note_arm_p2sh_multisig(0);
                return Some(Ok(true));
            }

            let mut sig_index = 0;
            let mut valid_sigs = 0u8;

            // Pubkeys are script order and signatures are bottom-to-top.
            // CHECKMULTISIG pops the top signature against the last pubkey first.
            for pubkey_bytes in pubkeys.iter().rev() {
                if sig_index >= signatures.len() {
                    break;
                }
                let signature_bytes = &signatures[signatures.len() - 1 - sig_index];
                if signature_bytes.is_empty() {
                    continue;
                }
                if flags & crate::script::flags::SCRIPT_VERIFY_WITNESS_PUBKEYTYPE != 0
                    && !(pubkey_bytes.len() == 33
                        && (pubkey_bytes[0] == 0x02 || pubkey_bytes[0] == 0x03))
                {
                    return Some(Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::WitnessPubkeyType,
                        message: "witness v0 public key must be compressed".into(),
                    }));
                }
                let sighash_byte = signature_bytes[signature_bytes.len() - 1];
                match crate::transaction_hash::calculate_bip143_sighash(
                    tx,
                    input_index,
                    script_code,
                    amount,
                    sighash_byte,
                    precomputed_bip143,
                ) {
                    Ok(sighash) => {
                        let is_valid = signature::with_secp_context(|secp| {
                            signature::verify_signature(
                                secp,
                                pubkey_bytes,
                                signature_bytes,
                                &sighash,
                                flags,
                                height,
                                network,
                                SigVersion::WitnessV0,
                            )
                        });
                        match is_valid {
                            Ok(v) if v => {
                                valid_sigs += 1;
                                sig_index += 1;
                            }
                            Ok(_) => {}
                            Err(e) => return Some(Err(e)),
                        }
                    }
                    Err(e) => return Some(Err(e)),
                }
            }

            let success = signatures.len() == usize::from(m) && valid_sigs == m;
            if let Err(e) = failed_multisig_nullfail(
                flags,
                success,
                signatures.iter().any(|sig| !sig.is_empty()),
            ) {
                return Some(Err(e));
            }
            return Some(Ok(success));
        }
    }

    // Witness script uses interpreter path (no batch collection).
    // CHECKMULTISIG in witness script can produce invalid sig/pubkey pairings for batch.
    let mut stack: Vec<StackElement> = witness
        .iter()
        .take(witness.len() - 1)
        .map(|w| to_stack_element(w))
        .collect();
    let result = eval_script_with_context_full_inner(
        witness_script,
        &mut stack,
        flags,
        tx,
        input_index,
        prevout_values,
        prevout_script_pubkeys,
        block_height,
        median_time_past,
        network,
        witness_sigversion,
        Some(witness_script), // BIP143 scriptCode for CHECKSIG inside P2WSH
        None,                 // script_sig_for_sighash (witness script context)
        None,                 // taproot_annex_hash
        None,                 // tapscript_validation_weight
        schnorr_collector,
        precomputed_bip143,
        #[cfg(feature = "production")]
        sighash_cache,
    );
    Some(result)
}

/// P2TR script-path tapscript P2PK fast path. Tapscript PUSH_32_BYTES <32-byte-pubkey> OP_CHECKSIG, witness [sig, script, control_block].
#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
fn try_verify_p2tr_scriptpath_p2pk_fast_path(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    witness: &crate::witness::Witness,
    _flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    network: crate::types::Network,
    schnorr_collector: Option<&crate::bip348::SchnorrSignatureCollector>,
) -> Option<Result<bool>> {
    use crate::activation::taproot_active_at_height;
    use crate::taproot::parse_taproot_script_path_witness;

    if !taproot_active_at_height(block_height, network) {
        return None;
    }
    if script_pubkey.len() != 34 || script_pubkey[0] != OP_1 || script_pubkey[1] != PUSH_32_BYTES {
        return None;
    }
    if !script_sig.is_empty() {
        return None;
    }
    if witness.len() < 2 {
        return None;
    }
    let mut output_key = [0u8; 32];
    output_key.copy_from_slice(&script_pubkey[2..34]);
    let (witness_body, annex_hash) = crate::taproot::strip_taproot_annex(witness);
    let parsed = match parse_taproot_script_path_witness(&witness_body, &output_key) {
        Ok(Some(p)) => p,
        Ok(None) | Err(_) => return None,
    };
    let (tapscript, stack_items, control_block) = parsed;
    if control_block.leaf_version != crate::taproot::TAPROOT_LEAF_VERSION_TAPSCRIPT {
        return None;
    }
    if tapscript.len() != 34 || tapscript[0] != PUSH_32_BYTES || tapscript[33] != OP_CHECKSIG {
        return None;
    }
    if stack_items.len() != 1 {
        return None;
    }
    let (sig_bytes, sighash_type) =
        crate::bip348::try_parse_taproot_schnorr_witness_sig(stack_items[0].as_ref())?;
    let pubkey_32 = &tapscript[1..33];
    let sighash = crate::taproot::compute_tapscript_signature_hash(
        tx,
        input_index,
        prevout_values,
        prevout_script_pubkeys,
        &tapscript,
        control_block.leaf_version,
        0xffff_ffff,
        sighash_type,
        annex_hash.as_ref(),
    )
    .ok()?;
    let result = crate::bip348::verify_tapscript_schnorr_signature(
        &sighash,
        pubkey_32,
        &sig_bytes,
        schnorr_collector,
    );
    Some(result)
}

/// 64-byte Schnorr signatures use sighash `0x00`. A 65th byte of `0x00` is invalid.
fn parse_taproot_keypath_sig(sig_bytes: &[u8]) -> Option<([u8; 64], u8)> {
    match sig_bytes.len() {
        64 => {
            let mut sig = [0u8; 64];
            sig.copy_from_slice(sig_bytes);
            Some((sig, 0x00))
        }
        65 => {
            let hashtype = sig_bytes[64];
            if hashtype == 0x00 {
                return None;
            }
            let mut sig = [0u8; 64];
            sig.copy_from_slice(&sig_bytes[..64]);
            Some((sig, hashtype))
        }
        _ => None,
    }
}

/// Taproot (P2TR) key-path fast-path. ScriptPubKey OP_1 <32-byte output key>, witness [64-byte sig].
/// Skips interpreter; verifies Schnorr directly. Returns None for script-path or pre-activation.
#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
fn verify_p2tr_keypath_witness(
    script_pubkey: &[u8],
    witness: &crate::witness::Witness,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    schnorr_collector: Option<&crate::bip348::SchnorrSignatureCollector>,
) -> Result<bool> {
    use crate::bip348::{
        try_parse_taproot_schnorr_witness_sig, verify_tapscript_schnorr_signature,
    };

    let (witness_body, annex_hash) = crate::taproot::strip_taproot_annex(witness);
    if witness_body.len() != 1 {
        return Ok(false);
    }
    let Some((sig_bytes, sighash_type)) = try_parse_taproot_schnorr_witness_sig(&witness_body[0])
    else {
        return Ok(false);
    };
    let output_key = &script_pubkey[2..34];
    let sighash = crate::taproot::compute_taproot_signature_hash(
        tx,
        input_index,
        prevout_values,
        prevout_script_pubkeys,
        sighash_type,
        annex_hash.as_ref(),
    )?;
    verify_tapscript_schnorr_signature(&sighash, output_key, &sig_bytes, schnorr_collector)
}

#[cfg(feature = "production")]
#[allow(clippy::too_many_arguments)]
fn try_verify_p2tr_keypath_fast_path(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    witness: &crate::witness::Witness,
    _flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    network: crate::types::Network,
    schnorr_collector: Option<&crate::bip348::SchnorrSignatureCollector>,
) -> Option<Result<bool>> {
    use crate::activation::taproot_active_at_height;
    if !taproot_active_at_height(block_height, network) {
        return None;
    }
    // P2TR: 34 bytes = OP_1 PUSH_32_BYTES <32-byte output key>
    if script_pubkey.len() != 34 || script_pubkey[0] != OP_1 || script_pubkey[1] != PUSH_32_BYTES {
        return None;
    }
    if !script_sig.is_empty() {
        return None;
    }
    // Key-path: one stack element after optional annex strip (BIP340 Schnorr check).
    let (witness_body, _) = crate::taproot::strip_taproot_annex(witness);
    if witness_body.len() != 1 {
        return None;
    }
    crate::bip348::try_parse_taproot_schnorr_witness_sig(&witness_body[0])?;
    Some(verify_p2tr_keypath_witness(
        script_pubkey,
        witness,
        tx,
        input_index,
        prevout_values,
        prevout_script_pubkeys,
        schnorr_collector,
    ))
}

#[cfg_attr(feature = "spec-lock", spec_locked("5.2", "VerifyScript"))]
pub fn verify_script_with_context_full(
    script_sig: &ByteString,
    script_pubkey: &[u8],
    witness: Option<&crate::witness::Witness>,
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    median_time_past: Option<u64>,
    network: crate::types::Network,
    _sigversion: SigVersion,
    #[cfg(feature = "production")] schnorr_collector: Option<
        &crate::bip348::SchnorrSignatureCollector,
    >,
    precomputed_bip143: Option<&crate::transaction_hash::Bip143PrecomputedHashes>,
    #[cfg(feature = "production")] precomputed_sighash_all: Option<[u8; 32]>,
    #[cfg(feature = "production")] sighash_cache: Option<
        &crate::transaction_hash::SighashMidstateCache,
    >,
    #[cfg(feature = "production")] precomputed_p2pkh_hash: Option<[u8; 20]>,
    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))] ecdsa_collect: Option<(
        &crate::ecdsa_batch::EcdsaSignatureCollector,
        usize,
    )>,
) -> Result<bool> {
    // libbitcoin-consensus check (multi-input verify_script): prevouts length must match vin size
    if prevout_values.len() != tx.inputs.len() || prevout_script_pubkeys.len() != tx.inputs.len() {
        return Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::TxInputInvalid,
            message: format!(
                "Prevout slices: values={}, script_pubkeys={}, input_count={} (input_idx={})",
                prevout_values.len(),
                prevout_script_pubkeys.len(),
                tx.inputs.len(),
                input_index,
            )
            .into(),
        });
    }

    // libbitcoin-consensus check: prevout.value must not exceed i64::MAX
    // In libbitcoin-consensus: if (prevout.value > std::numeric_limits<int64_t>::max())
    // This prevents value overflow in TransactionSignatureChecker
    // Note: Our value is already i64, so it can't exceed i64::MAX by definition
    // But we validate it's non-negative and within MAX_MONEY bounds for safety
    if input_index < prevout_values.len() {
        let prevout_value = prevout_values[input_index];
        if prevout_value < 0 {
            return Err(ConsensusError::ScriptErrorWithCode {
                code: ScriptErrorCode::ValueOverflow,
                message: "Prevout value cannot be negative".into(),
            });
        }
        #[cfg(feature = "production")]
        {
            use precomputed_constants::MAX_MONEY_U64;
            if (prevout_value as u64) > MAX_MONEY_U64 {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::ValueOverflow,
                    message: format!("Prevout value {prevout_value} exceeds MAX_MONEY").into(),
                });
            }
        }
        #[cfg(not(feature = "production"))]
        {
            use crate::constants::MAX_MONEY;
            if prevout_value > MAX_MONEY {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::ValueOverflow,
                    message: format!("Prevout value {prevout_value} exceeds MAX_MONEY").into(),
                });
            }
        }
    }

    // libbitcoin-consensus check: input_index must be valid
    if input_index >= tx.inputs.len() {
        return Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::TxInputInvalid,
            message: format!(
                "Input index {} out of bounds (tx has {} inputs)",
                input_index,
                tx.inputs.len()
            )
            .into(),
        });
    }

    // P2PK / P2PKH / P2SH fast-paths — skip interpreter for common legacy scripts
    #[cfg(feature = "production")]
    if !fast_paths_disabled() && witness.is_none() {
        if let Some(result) = try_verify_p2pk_fast_path(
            script_sig,
            script_pubkey,
            flags,
            tx,
            input_index,
            prevout_values,
            prevout_script_pubkeys,
            block_height,
            network,
            #[cfg(feature = "production")]
            sighash_cache,
        ) {
            FAST_PATH_P2PK.fetch_add(1, Ordering::Relaxed);
            return result;
        }
        if let Some(result) = try_verify_p2pkh_fast_path(
            script_sig,
            script_pubkey,
            flags,
            tx,
            input_index,
            prevout_values,
            prevout_script_pubkeys,
            block_height,
            network,
            #[cfg(feature = "production")]
            precomputed_sighash_all,
            #[cfg(feature = "production")]
            sighash_cache,
            #[cfg(feature = "production")]
            precomputed_p2pkh_hash,
        ) {
            FAST_PATH_P2PKH.fetch_add(1, Ordering::Relaxed);
            return result;
        }
        if let Some(result) = try_verify_p2sh_fast_path(
            script_sig,
            script_pubkey,
            flags,
            tx,
            input_index,
            prevout_values,
            prevout_script_pubkeys,
            block_height,
            median_time_past,
            network,
            #[cfg(feature = "production")]
            sighash_cache,
            #[cfg(feature = "production")]
            precomputed_sighash_all,
            #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
            ecdsa_collect,
        ) {
            FAST_PATH_P2SH.fetch_add(1, Ordering::Relaxed);
            return result;
        }
        if let Some(result) = try_verify_bare_multisig_fast_path(
            script_sig,
            script_pubkey,
            flags,
            tx,
            input_index,
            prevout_values,
            prevout_script_pubkeys,
            block_height,
            network,
            #[cfg(feature = "production")]
            sighash_cache,
        ) {
            FAST_PATH_BARE_MULTISIG.fetch_add(1, Ordering::Relaxed);
            return result;
        }
    }
    // P2WPKH / P2WSH / P2WPKH-in-P2SH fast-paths when witness present
    #[cfg(feature = "production")]
    if !fast_paths_disabled() {
        if let Some(wit) = witness {
            if let Some(result) = try_verify_p2wpkh_in_p2sh_fast_path(
                script_sig,
                script_pubkey,
                wit,
                flags,
                tx,
                input_index,
                prevout_values,
                prevout_script_pubkeys,
                block_height,
                network,
                precomputed_bip143,
                #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
                ecdsa_collect,
            ) {
                FAST_PATH_P2WPKH.fetch_add(1, Ordering::Relaxed);
                return result;
            }
            if let Some(result) = try_verify_p2wsh_in_p2sh_fast_path(
                script_sig,
                script_pubkey,
                wit,
                flags,
                tx,
                input_index,
                prevout_values,
                prevout_script_pubkeys,
                block_height,
                median_time_past,
                network,
                schnorr_collector,
                precomputed_bip143,
                #[cfg(feature = "production")]
                sighash_cache,
                #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
                ecdsa_collect,
            ) {
                FAST_PATH_P2WSH.fetch_add(1, Ordering::Relaxed);
                return result;
            }
            if let Some(result) = try_verify_p2wpkh_fast_path(
                script_sig,
                script_pubkey,
                wit,
                flags,
                tx,
                input_index,
                prevout_values,
                prevout_script_pubkeys,
                block_height,
                network,
                precomputed_bip143,
                precomputed_sighash_all,
                #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
                ecdsa_collect,
            ) {
                FAST_PATH_P2WPKH.fetch_add(1, Ordering::Relaxed);
                return result;
            }
            if let Some(result) = try_verify_p2wsh_fast_path(
                script_sig,
                script_pubkey,
                wit,
                flags,
                tx,
                input_index,
                prevout_values,
                prevout_script_pubkeys,
                block_height,
                median_time_past,
                network,
                schnorr_collector,
                precomputed_bip143,
                #[cfg(feature = "production")]
                sighash_cache,
                #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
                ecdsa_collect,
            ) {
                FAST_PATH_P2WSH.fetch_add(1, Ordering::Relaxed);
                return result;
            }
            if let Some(result) = try_verify_p2tr_scriptpath_p2pk_fast_path(
                script_sig,
                script_pubkey,
                wit,
                flags,
                tx,
                input_index,
                prevout_values,
                prevout_script_pubkeys,
                block_height,
                network,
                schnorr_collector,
            ) {
                FAST_PATH_P2TR.fetch_add(1, Ordering::Relaxed);
                return result;
            }
            if let Some(result) = crate::script::templates::try_verify_p2tr_unexec_if_fast_path(
                script_sig,
                script_pubkey,
                wit,
                flags,
                tx,
                input_index,
                prevout_values,
                prevout_script_pubkeys,
                block_height,
                network,
                schnorr_collector,
            ) {
                FAST_PATH_UNEXEC_IF.fetch_add(1, Ordering::Relaxed);
                return result;
            }
            if let Some(result) = try_verify_p2tr_keypath_fast_path(
                script_sig,
                script_pubkey,
                wit,
                flags,
                tx,
                input_index,
                prevout_values,
                prevout_script_pubkeys,
                block_height,
                network,
                schnorr_collector,
            ) {
                FAST_PATH_P2TR.fetch_add(1, Ordering::Relaxed);
                return result;
            }
        }
    }
    #[cfg(feature = "production")]
    FAST_PATH_INTERPRETER.fetch_add(1, Ordering::Relaxed);

    // P2SH handling: If SCRIPT_VERIFY_P2SH flag is set and scriptPubkey is P2SH format,
    // we need to check scriptSig push-only BEFORE executing it
    // P2SH scriptPubkey format: OP_HASH160 <20-byte-hash> OP_EQUAL
    let is_p2sh = (flags & flags::SCRIPT_VERIFY_P2SH) != 0
        && script_pubkey.len() == 23  // OP_HASH160 (1) + push 20 (1) + 20 bytes + OP_EQUAL (1) = 23
        && script_pubkey[0] == OP_HASH160   // OP_HASH160
        && script_pubkey[1] == PUSH_20_BYTES   // push 20 bytes
        && script_pubkey[22] == OP_EQUAL; // OP_EQUAL

    // Where the last scriptSig push lives. Data pushes are already in `script_sig`.
    enum RedeemSource {
        Absent,
        Empty,
        Slice(usize, usize),
        Number(i64),
        StackCopy,
    }
    let mut redeem_source = RedeemSource::Absent;

    // CRITICAL: For P2SH, scriptSig MUST only contain push operations (data pushes only)
    // This prevents script injection attacks. If scriptSig contains non-push opcodes, fail immediately.
    // This check MUST happen BEFORE executing scriptSig
    // Note: We validate push-only by attempting to parse scriptSig as push-only
    // If we encounter any non-push opcode OR invalid push encoding, we fail
    if is_p2sh {
        let mut i = 0;
        while i < script_sig.len() {
            let opcode = script_sig[i];
            if !is_push_opcode(opcode) {
                // Non-push opcode found in P2SH scriptSig - this is invalid
                return Ok(false);
            }
            // Advance past the push opcode and data. Remember the last push: that is the redeem script.
            if opcode == OP_0 {
                // OP_0 - push empty array, no data to skip
                redeem_source = RedeemSource::Empty;
                i += 1;
            } else if opcode <= 0x4b {
                // Direct push: opcode is the length (1-75 bytes)
                let len = opcode as usize;
                if i + 1 + len > script_sig.len() {
                    return Ok(false); // Invalid push length
                }
                redeem_source = RedeemSource::Slice(i + 1, i + 1 + len);
                i += 1 + len;
            } else if opcode == OP_PUSHDATA1 {
                // OP_PUSHDATA1
                if i + 1 >= script_sig.len() {
                    return Ok(false);
                }
                let len = script_sig[i + 1] as usize;
                if i + 2 + len > script_sig.len() {
                    return Ok(false);
                }
                redeem_source = RedeemSource::Slice(i + 2, i + 2 + len);
                i += 2 + len;
            } else if opcode == OP_PUSHDATA2 {
                // OP_PUSHDATA2
                if i + 2 >= script_sig.len() {
                    return Ok(false);
                }
                let len = u16::from_le_bytes([script_sig[i + 1], script_sig[i + 2]]) as usize;
                if i + 3 + len > script_sig.len() {
                    return Ok(false);
                }
                redeem_source = RedeemSource::Slice(i + 3, i + 3 + len);
                i += 3 + len;
            } else if opcode == OP_PUSHDATA4 {
                // OP_PUSHDATA4
                if i + 4 >= script_sig.len() {
                    return Ok(false);
                }
                let len = u32::from_le_bytes([
                    script_sig[i + 1],
                    script_sig[i + 2],
                    script_sig[i + 3],
                    script_sig[i + 4],
                ]) as usize;
                if i + 5 + len > script_sig.len() {
                    return Ok(false);
                }
                redeem_source = RedeemSource::Slice(i + 5, i + 5 + len);
                i += 5 + len;
            } else if opcode == OP_1NEGATE || (OP_1..=OP_16).contains(&opcode) {
                // Numeric pushes. The stack item is the CScriptNum, not a slice of scriptSig.
                redeem_source = RedeemSource::Number(script_num_from_opcode(opcode));
                i += 1;
            } else if (OP_1NEGATE..=OP_16).contains(&opcode) {
                // OP_RESERVED. Not a data push. Execution fails before the redeem is used.
                redeem_source = RedeemSource::StackCopy;
                i += 1;
            } else {
                // Should not reach here if is_push_opcode is correct, but fail anyway
                return Ok(false);
            }
        }
        #[cfg(feature = "production")]
        let run_fast_paths = !fast_paths_disabled();
        #[cfg(not(feature = "production"))]
        let run_fast_paths = true;
        if run_fast_paths {
            if let Some(result) = try_verify_p2sh_multisig_fast_path(
                script_sig,
                script_pubkey,
                flags,
                tx,
                input_index,
                prevout_values,
                prevout_script_pubkeys,
                block_height,
                network,
                #[cfg(feature = "production")]
                sighash_cache,
                #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
                ecdsa_collect.map(|(c, _)| c),
            ) {
                return result;
            }
        }
    }

    #[cfg(feature = "production")]
    let mut _stack_guard = PooledStackGuard(get_pooled_stack());
    #[cfg(feature = "production")]
    let stack = &mut _stack_guard.0;
    #[cfg(not(feature = "production"))]
    let mut stack_buf: Vec<StackElement> = Vec::with_capacity(20);
    #[cfg(not(feature = "production"))]
    let stack = &mut stack_buf;

    // Execute scriptSig (always Base sigversion)
    // FIX: scriptSig can contain CHECKSIG/CHECKMULTISIG (non-standard); collecting produces invalid
    // (sig, pubkey) pairings. Only fast paths (P2PKH, P2WPKH, P2WSH) have correct 1:1 pairing.
    let script_sig_result = eval_script_with_context_full(
        script_sig,
        stack,
        flags,
        tx,
        input_index,
        prevout_values,
        prevout_script_pubkeys,
        block_height,
        median_time_past,
        network,
        SigVersion::Base,
        None, // redeem_script_for_sighash
        None, // script_sig not needed when executing scriptSig
        None, // taproot_annex_hash
        None, // tapscript_validation_weight
        #[cfg(feature = "production")]
        schnorr_collector,
        None, // precomputed_bip143 - Base sigversion
        #[cfg(feature = "production")]
        sighash_cache,
    )?;
    if !script_sig_result {
        return Ok(false);
    }

    // The redeem script is the last scriptSig push. Data pushes borrow `script_sig`.
    // scriptPubkey pops that stack item, so the borrow cannot point at the stack.
    let mut numeric_redeem = script_num_encode(0);
    let mut copied_redeem: Option<ByteString> = None;
    if is_p2sh && !stack.is_empty() {
        match redeem_source {
            RedeemSource::Number(n) => numeric_redeem = script_num_encode(n),
            RedeemSource::StackCopy | RedeemSource::Absent => {
                copied_redeem = Some(
                    stack
                        .last()
                        .expect("Stack is not empty")
                        .as_slice()
                        .to_vec(),
                );
            }
            RedeemSource::Empty | RedeemSource::Slice(_, _) => {}
        }
    }
    let redeem_script: Option<&[u8]> = if is_p2sh && !stack.is_empty() {
        match redeem_source {
            RedeemSource::Slice(start, end) => Some(&script_sig[start..end]),
            RedeemSource::Empty => Some(&[]),
            RedeemSource::Number(_) => Some(&numeric_redeem[..]),
            RedeemSource::StackCopy | RedeemSource::Absent => copied_redeem.as_deref(),
        }
    } else {
        None
    };
    let nested_witness_program = redeem_script.as_ref().is_some_and(|redeem| {
        redeem.len() >= 3
            && redeem[0] == OP_0
            && ((redeem[1] == PUSH_20_BYTES && redeem.len() == 22)
                || (redeem[1] == PUSH_32_BYTES && redeem.len() == 34))
    });
    // Nested v0 scriptSig must be the canonical push of the redeem script.
    if nested_witness_program
        && !redeem_push_is_canonical(
            script_sig.as_ref(),
            redeem_script.as_ref().expect("nested redeem"),
        )
    {
        return Ok(false);
    }

    // Taproot format: [OP_1, PUSH_32_BYTES, <32 bytes>] = 34 bytes total.
    // The byte check comes first so a non-matching output skips the activation lookup.
    use crate::activation::taproot_active_at_height;
    use crate::script::flags::{
        SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM, SCRIPT_VERIFY_WITNESS,
    };
    let witness_flag = flags & SCRIPT_VERIFY_WITNESS != 0;
    let v1_32 =
        script_pubkey.len() == 34 && script_pubkey[0] == OP_1 && script_pubkey[1] == PUSH_32_BYTES;
    let is_taproot =
        redeem_script.is_none() && v1_32 && taproot_active_at_height(block_height, network);

    // If Taproot, scriptSig must be empty
    if is_taproot && !script_sig.is_empty() {
        return Ok(false); // Taproot requires empty scriptSig
    }

    // Future witness programs, and a v1 32-byte program before Taproot activation.
    // Empty scriptSig, witness ignored. After activation `is_taproot` handles v1-32.
    let untaproot_v1 = witness_flag && !is_taproot && v1_32;
    if redeem_script.is_none()
        && !is_taproot
        && (untaproot_v1 || crate::witness::is_upgradable_witness_program(script_pubkey))
    {
        if !script_sig.is_empty() {
            return Ok(false);
        }
        if !witness_flag {
            return Ok(false);
        }
        // Native pay-to-anchor is standard with an empty witness. A wrapped
        // anchor stays on the discourage path below.
        if crate::witness::is_pay_to_anchor(script_pubkey) {
            return Ok(true);
        }
        if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM) != 0 {
            return Ok(false);
        }
        // The program is the stack top after scriptPubKey execution. A false
        // top fails before the future-version success path.
        if !cast_to_bool(&script_pubkey[2..]) {
            return Ok(false);
        }
        return Ok(true);
    }

    // Native v0 witness programs (BIP141). Only when SCRIPT_VERIFY_WITNESS is set.
    // With the flag clear, OP_0 <20>/<32> is a bare script.
    // P2WPKH: [OP_0, PUSH_20_BYTES, <20 bytes>] = 22 bytes
    // P2WSH: [OP_0, PUSH_32_BYTES, <32 bytes>] = 34 bytes
    // v0 programs must be 20 or 32 bytes. Other lengths are not future witness versions.
    if witness_flag
        && redeem_script.is_none()
        && crate::witness::is_invalid_v0_witness_program(script_pubkey)
    {
        return Ok(false);
    }
    let is_direct_witness_program = witness_flag
        && redeem_script.is_none()
        && !is_taproot
        && crate::witness::is_standard_witness_program(script_pubkey)
        && script_pubkey[0] == OP_0;

    if is_direct_witness_program {
        // scriptPubKey execution leaves the program on top. A false program
        // fails before witness verification.
        if !cast_to_bool(&script_pubkey[2..]) {
            return Ok(false);
        }
        // Non-empty scriptSig is WITNESS_MALLEATED.
        if !script_sig.is_empty() {
            return Ok(false);
        }
        let Some(witness_stack) = witness else {
            return Ok(false);
        };
        if script_pubkey[1] == PUSH_32_BYTES {
            if witness_stack.is_empty() {
                return Ok(false);
            }
            let witness_script = witness_stack.last().expect("Witness stack is not empty");
            let program_bytes = &script_pubkey[2..];
            if program_bytes.len() != 32 {
                return Ok(false);
            }
            let witness_script_hash = OptimizedSha256::new().hash(witness_script.as_ref());
            if &witness_script_hash[..] != program_bytes {
                return Ok(false);
            }
            let max_witness_elem = MAX_SCRIPT_ELEMENT_SIZE;
            for element in witness_stack.iter().take(witness_stack.len() - 1) {
                if element.len() > max_witness_elem {
                    return Ok(false);
                }
            }
            // Fresh stack: scriptSig leftovers must not sit under the witness items.
            stack.clear();
            for element in witness_stack.iter().take(witness_stack.len() - 1) {
                stack.push(to_stack_element(element));
            }
            return eval_script_with_context_full(
                witness_script,
                stack,
                flags,
                tx,
                input_index,
                prevout_values,
                prevout_script_pubkeys,
                block_height,
                median_time_past,
                network,
                SigVersion::WitnessV0,
                Some(witness_script.as_ref()),
                None,
                None,
                None, // tapscript_validation_weight
                #[cfg(feature = "production")]
                schnorr_collector,
                precomputed_bip143,
                #[cfg(feature = "production")]
                sighash_cache,
            );
        } else if script_pubkey[1] == PUSH_20_BYTES {
            if witness_stack.len() != 2 {
                return Ok(false);
            }
            let signature_bytes = &witness_stack[0];
            let pubkey_bytes = &witness_stack[1];
            if signature_bytes.is_empty() {
                return Ok(false);
            }
            if pubkey_bytes.len() != 33 && pubkey_bytes.len() != 65 {
                return Ok(false);
            }
            let max_witness_elem = MAX_SCRIPT_ELEMENT_SIZE;
            if signature_bytes.len() > max_witness_elem || pubkey_bytes.len() > max_witness_elem {
                return Ok(false);
            }
            let pubkey_hash = &script_pubkey[2..22];
            let pubkey_sha256 = OptimizedSha256::new().hash(pubkey_bytes);
            let computed_hash = Ripemd160::digest(pubkey_sha256);
            if &computed_hash[..] != pubkey_hash {
                return Ok(false);
            }
            let sighash_byte = signature_bytes[signature_bytes.len() - 1];
            let amount = prevout_values.get(input_index).copied().unwrap_or(0);
            let p2pkh_script_code = bip143_p2wpkh_script_code(pubkey_hash);
            let sighash = crate::transaction_hash::calculate_bip143_sighash(
                tx,
                input_index,
                &p2pkh_script_code,
                amount,
                sighash_byte,
                precomputed_bip143,
            )?;
            let height = block_height.unwrap_or(0);
            return signature::with_secp_context(|secp| {
                signature::verify_signature(
                    secp,
                    pubkey_bytes,
                    signature_bytes,
                    &sighash,
                    flags,
                    height,
                    network,
                    SigVersion::WitnessV0,
                )
            });
        } else {
            return Ok(false);
        }
    }

    if is_taproot {
        let Some(witness_stack) = witness else {
            return Ok(false);
        };
        if witness_stack.is_empty() {
            return Ok(false);
        }
        // After optional annex strip: 1 element = key-path; 2+ = script-path (BIP341).
        let (witness_body, annex_hash) = crate::taproot::strip_taproot_annex(witness_stack);
        if witness_body.is_empty() {
            return Ok(false);
        }
        if witness_body.len() == 1 {
            #[cfg(feature = "production")]
            {
                return verify_p2tr_keypath_witness(
                    script_pubkey,
                    witness_stack,
                    tx,
                    input_index,
                    prevout_values,
                    prevout_script_pubkeys,
                    schnorr_collector,
                );
            }
            #[cfg(not(feature = "production"))]
            {
                if witness_body.len() != 1 {
                    return Ok(false);
                }
                let Some((sig_bytes, sighash_type)) =
                    parse_taproot_keypath_sig(witness_body[0].as_ref())
                else {
                    return Ok(false);
                };
                let output_key = &script_pubkey[2..34];
                let sighash = crate::taproot::compute_taproot_signature_hash(
                    tx,
                    input_index,
                    prevout_values,
                    prevout_script_pubkeys,
                    sighash_type,
                    annex_hash.as_ref(),
                )?;
                let mut pubkey = [0u8; 32];
                pubkey.copy_from_slice(output_key);
                return crate::secp256k1_backend::verify_schnorr(&sig_bytes, &sighash, &pubkey);
            }
        }
        if witness_body.len() < 2 {
            return Ok(false);
        }
        let mut output_key = [0u8; 32];
        output_key.copy_from_slice(&script_pubkey[2..34]);
        match crate::taproot::parse_taproot_script_path_witness(&witness_body, &output_key)? {
            None => return Ok(false),
            Some((tapscript, stack_items, control_block)) => {
                if control_block.leaf_version != crate::taproot::TAPROOT_LEAF_VERSION_TAPSCRIPT {
                    use crate::script::flags::SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION;
                    if flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION != 0 {
                        return Ok(false);
                    }
                    return Ok(true);
                }
                for item in &stack_items {
                    stack.push(to_stack_element(item));
                }
                if !eval_script_with_context_full(
                    &tapscript,
                    stack,
                    flags,
                    tx,
                    input_index,
                    prevout_values,
                    prevout_script_pubkeys,
                    block_height,
                    median_time_past,
                    network,
                    SigVersion::Tapscript,
                    None, // redeem_script_for_sighash
                    None, // script_sig_for_sighash
                    annex_hash.as_ref(),
                    Some(crate::taproot::witness_stack_serialize_size(witness_stack) + 50),
                    #[cfg(feature = "production")]
                    schnorr_collector,
                    None,
                    #[cfg(feature = "production")]
                    sighash_cache,
                )? {
                    return Ok(false);
                }
                return Ok(true);
            }
        }
    }

    // Execute scriptPubkey (always Base sigversion)
    // For P2WPKH/P2WSH, witness stack elements are already on the stack
    // Pass script_sig so legacy sighash uses same signature bytes as fast path (FindAndDelete pattern).
    // Interpreter path: verify in-place only. Interpreter sighash can diverge from
    // fast path (e.g. CHECKMULTISIG), causing batch to store invalid triples. Verify in-place only.
    // Thread-local guard ensures we never collect even if a collector is accidentally threaded through.
    let script_pubkey_result = eval_script_with_context_full(
        script_pubkey,
        stack,
        flags,
        tx,
        input_index,
        prevout_values,
        prevout_script_pubkeys,
        block_height,
        median_time_past,
        network,
        SigVersion::Base,
        None, // redeem_script_for_sighash
        Some(script_sig),
        None, // taproot_annex_hash
        None, // tapscript_validation_weight
        #[cfg(feature = "production")]
        schnorr_collector,
        None, // precomputed_bip143 - Base sigversion
        #[cfg(feature = "production")]
        sighash_cache,
    )?;
    if !script_pubkey_result {
        return Ok(false);
    }

    // P2SH: If scriptPubkey verified the hash, we need to execute the redeem script
    // The scriptPubkey (OP_HASH160 <hash> OP_EQUAL) pops the redeem script, hashes it, compares
    // After scriptPubkey execution, if successful, stack should have [sig1, sig2, ..., 1]
    // where 1 is the OP_EQUAL result (true)
    if let Some(redeem) = redeem_script {
        // Verify stack has at least one element (the OP_EQUAL result)
        if stack.is_empty() {
            return Ok(false); // scriptPubkey execution failed
        }

        // Verify top element is non-zero (OP_EQUAL returned 1 = hash matched)
        let top = stack.last().expect("Stack is not empty");
        if !cast_to_bool(top) {
            return Ok(false); // Hash didn't match or scriptPubkey failed
        }

        // Pop the OP_EQUAL result (1) - this was pushed by OP_EQUAL when hashes matched
        stack.pop();

        // Check if redeem script is a witness program (P2WSH-in-P2SH or P2WPKH-in-P2SH)
        // Witness program format: OP_0 (0x00) + push opcode + program bytes
        // P2WPKH: [OP_0, PUSH_20_BYTES, <20 bytes>] = 22 bytes total
        // P2WSH: [OP_0, PUSH_32_BYTES, <32 bytes>] = 34 bytes total
        let is_witness_program =
            crate::witness::is_standard_witness_program(redeem) && redeem[0] == OP_0;

        if witness_flag && crate::witness::is_invalid_v0_witness_program(redeem) {
            return Ok(false);
        }

        if witness_flag && is_witness_program {
            if !cast_to_bool(&redeem[2..]) {
                return Ok(false);
            }
            // For P2WSH-in-P2SH or P2WPKH-in-P2SH:
            // - We've already verified the redeem script hash matches (scriptPubkey check passed)
            // - We should NOT execute the redeem script as a normal script
            // - Extract the witness program from redeem script (program bytes after OP_0 and push opcode)
            // - For P2WPKH-in-P2SH: witness script is pubkey hash (20 bytes), witness contains signature + pubkey
            // - For P2WSH-in-P2SH: witness script is the last witness element, hash must match program (32 bytes)

            // Extract program from redeem script: skip OP_0 (1 byte) + push opcode (1 byte), get program bytes
            let program_bytes = &redeem[2..];

            if redeem[1] == PUSH_32_BYTES {
                // P2WSH-in-P2SH: program is 32 bytes, witness should contain the witness script as last element
                // The witness script's SHA256 hash must match the program
                if program_bytes.len() != 32 {
                    return Ok(false); // Invalid P2WSH program length
                }

                // CRITICAL FIX: For P2WSH-in-P2SH, witness is now the full Witness stack
                // Structure: [sig1, sig2, ..., witness_script]
                // The last element is the witness script, which we verify the hash of
                // Then we execute the witness script with the remaining elements (signatures) on the stack
                if let Some(witness_stack) = witness {
                    if witness_stack.is_empty() {
                        return Ok(false); // P2WSH requires witness
                    }

                    // Get the witness script (last element) - it's a ByteString (Vec<u8>)
                    let witness_script = witness_stack.last().expect("Witness stack is not empty");
                    let witness_script_hash = OptimizedSha256::new().hash(witness_script.as_ref());
                    if &witness_script_hash[..] != program_bytes {
                        return Ok(false); // Witness script hash doesn't match program
                    }

                    // Hash matches - now push witness stack elements (except the last one, which is the script)
                    // onto the stack, then execute the witness script
                    stack.clear();

                    // Push all witness stack elements except the last one (witness script) onto the stack
                    // These are the signatures and other data needed for witness script execution
                    let max_witness_elem = MAX_SCRIPT_ELEMENT_SIZE;
                    for element in witness_stack.iter().take(witness_stack.len() - 1) {
                        if element.len() > max_witness_elem {
                            return Ok(false);
                        }
                        stack.push(to_stack_element(element));
                    }

                    // Execute the witness script with witness stack elements on the stack
                    // P2WSH-in-P2SH always uses WitnessV0 (BIP143). 0x8000 = WITNESS_PUBKEYTYPE
                    // is a key-type strictness flag and does not select Tapscript semantics.
                    let witness_sigversion = SigVersion::WitnessV0;

                    // Interpreter path: no collection (P2WSH-in-P2SH).
                    if !eval_script_with_context_full(
                        witness_script,
                        stack,
                        flags,
                        tx,
                        input_index,
                        prevout_values,
                        prevout_script_pubkeys,
                        block_height,
                        median_time_past,
                        network,
                        witness_sigversion,
                        Some(witness_script.as_ref()), // BIP143 scriptCode for CHECKSIG inside P2WSH-in-P2SH
                        None,                          // script_sig_for_sighash
                        None,                          // taproot_annex_hash
                        None,                          // tapscript_validation_weight
                        #[cfg(feature = "production")]
                        schnorr_collector,
                        precomputed_bip143, // WitnessV0 uses BIP143
                        #[cfg(feature = "production")]
                        sighash_cache,
                    )? {
                        return Ok(false);
                    }
                } else {
                    return Ok(false); // P2WSH requires witness
                }
            } else if redeem[1] == PUSH_20_BYTES {
                // P2WPKH-in-P2SH (BIP141): the redeem script is OP_0 <20-byte-pubkey-hash>.
                // Witness must be exactly [signature, pubkey].
                // Verify pubkey hashes to the program, then check BIP143 signature.
                let pubkey_hash = &redeem[2..22]; // 20-byte hash from redeem script

                let witness_stack = match witness {
                    Some(w) => w,
                    None => return Ok(false), // P2WPKH-in-P2SH requires witness
                };
                if witness_stack.len() != 2 {
                    return Ok(false); // Must be exactly [sig, pubkey]
                }
                let signature_bytes = &witness_stack[0];
                let pubkey_bytes = &witness_stack[1];

                if signature_bytes.is_empty() {
                    return Ok(false);
                }
                if pubkey_bytes.len() != 33 && pubkey_bytes.len() != 65 {
                    return Ok(false);
                }

                // Verify pubkey hash matches program
                let pubkey_sha256 = OptimizedSha256::new().hash(pubkey_bytes);
                let computed_hash = Ripemd160::digest(pubkey_sha256);
                if &computed_hash[..] != pubkey_hash {
                    return Ok(false);
                }

                // BIP143 §4.3: scriptCode for P2WPKH is the P2PKH expansion, not the witness program.
                let sighash_byte = signature_bytes[signature_bytes.len() - 1];
                let amount = prevout_values.get(input_index).copied().unwrap_or(0);
                let p2pkh_script_code = bip143_p2wpkh_script_code(pubkey_hash);
                let sighash = crate::transaction_hash::calculate_bip143_sighash(
                    tx,
                    input_index,
                    &p2pkh_script_code,
                    amount,
                    sighash_byte,
                    precomputed_bip143,
                )?;

                let height = block_height.unwrap_or(0);
                return signature::with_secp_context(|secp| {
                    signature::verify_signature(
                        secp,
                        pubkey_bytes,
                        signature_bytes,
                        &sighash,
                        flags,
                        height,
                        network,
                        SigVersion::WitnessV0,
                    )
                });
            } else {
                return Ok(false); // Invalid witness program format
            }
            // P2WSH-in-P2SH path falls through to final stack check above
        } else if witness_flag && crate::witness::is_any_witness_program(redeem) {
            // A P2SH-wrapped program that is not v0 P2WPKH/P2WSH is not taproot.
            // It succeeds when the redeem push is canonical, unless the
            // discourage-upgradable flag is set. Witness bytes are ignored.
            if !redeem_push_is_canonical(script_sig.as_ref(), redeem) {
                return Ok(false);
            }
            if flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM != 0 {
                return Ok(false);
            }
            if !cast_to_bool(&redeem[2..]) {
                return Ok(false);
            }
            return Ok(true);
        } else {
            // Regular P2SH: execute the redeem script with the remaining stack (signatures pushed by scriptSig)
            // The redeem script will consume the signatures and should leave exactly one true value
            // CRITICAL FIX: Pass redeem script for P2SH sighash calculation
            let redeem_result = eval_script_with_context_full_inner(
                redeem,
                stack,
                flags,
                tx,
                input_index,
                prevout_values,
                prevout_script_pubkeys,
                block_height,
                median_time_past,
                network,
                SigVersion::Base,
                Some(redeem),     // Pass redeem script for sighash
                Some(script_sig), // Use same script_sig for legacy sighash pattern (e.g. P2PKH inside P2SH)
                None,             // taproot_annex_hash
                None,             // tapscript_validation_weight
                #[cfg(feature = "production")]
                None, // schnorr_collector
                None,             // precomputed_bip143 - Base sigversion
                #[cfg(feature = "production")]
                sighash_cache,
            )?;
            if !redeem_result {
                return Ok(false);
            }
        }
    }

    // Stack size must not exceed consensus limit after scriptPubkey execution.
    if stack.len() > MAX_STACK_SIZE {
        return Ok(false);
    }

    // Execute witness if present
    // CRITICAL:
    // - Direct P2WPKH/P2WSH: Already handled above (witness stack pushed before scriptPubkey, witness script executed after)
    // - P2WSH-in-P2SH: Handled in P2SH section above (witness script executed with witness stack elements)
    // - P2WPKH-in-P2SH: Handled in P2SH section above (BIP143 sig/pubkey check via implicit P2PKH scriptCode)
    // - Regular scripts: No witness execution needed
    //
    // Fail closed when witness data is present but this spend is not a witness program path.
    // Do not require the witness parameter to be cleared: P2WSH-in-P2SH and similar paths
    // leave the original witness stack intact (see p2wsh_scriptcode_regression).
    let accepts_witness = is_direct_witness_program || is_taproot || nested_witness_program;
    if witness_flag {
        if let Some(witness_stack) = witness {
            if !crate::witness::witness_stack_is_null(witness_stack) && !accepts_witness {
                return Ok(false);
            }
        }
    }

    // Final validation
    // SCRIPT_VERIFY_CLEANSTACK (0x100): requires exactly 1 element on the stack
    // This is only a consensus rule for witness scripts (handled above in witness paths).
    // For legacy scripts in block validation, only the top stack element is checked
    // to be truthy (non-empty and non-zero). CLEANSTACK for legacy is mempool policy only.
    let final_result = if (flags & flags::SCRIPT_VERIFY_CLEANSTACK) != 0 {
        // CLEANSTACK: exactly one element, must be truthy
        stack.len() == 1 && cast_to_bool(&stack[0])
    } else {
        // Legacy: stack non-empty, top element is truthy
        !stack.is_empty() && cast_to_bool(stack.last().expect("Stack is not empty"))
    };
    Ok(final_result)
}

/// EvalScript with full context including block height, median time-past, and network
#[allow(clippy::too_many_arguments)]
fn eval_script_with_context_full(
    script: &[u8],
    stack: &mut Vec<StackElement>,
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    median_time_past: Option<u64>,
    network: crate::types::Network,
    sigversion: SigVersion,
    redeem_script_for_sighash: Option<&[u8]>,
    script_sig_for_sighash: Option<&ByteString>,
    taproot_annex_hash: Option<&Hash>,
    tapscript_validation_weight: Option<i64>,
    #[cfg(feature = "production")] schnorr_collector: Option<
        &crate::bip348::SchnorrSignatureCollector,
    >,
    precomputed_bip143: Option<&crate::transaction_hash::Bip143PrecomputedHashes>,
    #[cfg(feature = "production")] sighash_cache: Option<
        &crate::transaction_hash::SighashMidstateCache,
    >,
) -> Result<bool> {
    #[cfg(all(feature = "production", feature = "profile"))]
    let _t0 = std::time::Instant::now();
    let r = eval_script_with_context_full_inner(
        script,
        stack,
        flags,
        tx,
        input_index,
        prevout_values,
        prevout_script_pubkeys,
        block_height,
        median_time_past,
        network,
        sigversion,
        redeem_script_for_sighash,
        script_sig_for_sighash,
        taproot_annex_hash,
        tapscript_validation_weight,
        #[cfg(feature = "production")]
        schnorr_collector,
        precomputed_bip143,
        #[cfg(feature = "production")]
        sighash_cache,
    );
    #[cfg(all(feature = "production", feature = "profile"))]
    crate::script_profile::add_interpreter_ns(_t0.elapsed().as_nanos() as u64);
    r
}

/// Internal function with redeem script support for P2SH sighash
fn eval_script_with_context_full_inner(
    script: &[u8],
    stack: &mut Vec<StackElement>,
    flags: u32,
    tx: &Transaction,
    input_index: usize,
    prevout_values: &[i64],
    prevout_script_pubkeys: &[&[u8]],
    block_height: Option<u64>,
    median_time_past: Option<u64>,
    network: crate::types::Network,
    sigversion: SigVersion,
    redeem_script_for_sighash: Option<&[u8]>,
    script_sig_for_sighash: Option<&ByteString>,
    taproot_annex_hash: Option<&Hash>,
    tapscript_validation_weight: Option<i64>,
    #[cfg(feature = "production")] schnorr_collector: Option<
        &crate::bip348::SchnorrSignatureCollector,
    >,
    precomputed_bip143: Option<&crate::transaction_hash::Bip143PrecomputedHashes>,
    #[cfg(feature = "production")] sighash_cache: Option<
        &crate::transaction_hash::SighashMidstateCache,
    >,
) -> Result<bool> {
    // Precondition assertions: input_index and prevout lengths validated by caller (verify_script_with_context_full).
    // 6d: Removed redundant assert! for input_index and prevout lengths — caller returns error on mismatch.
    use crate::constants::{MAX_SCRIPT_ELEMENT_SIZE, MAX_SCRIPT_SIZE, MAX_STACK_SIZE};
    use crate::error::{ConsensusError, ScriptErrorCode};
    let weight_cell = tapscript_validation_weight.map(std::cell::Cell::new);

    // MAX_SCRIPT_SIZE applies to Base and WitnessV0 only; Tapscript may exceed 10k.
    if (sigversion == SigVersion::Base || sigversion == SigVersion::WitnessV0)
        && script.len() > MAX_SCRIPT_SIZE
    {
        return Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::ScriptSize,
            message: "Script size exceeds maximum".into(),
        });
    }
    // BIP342: In Tapscript, pre-scan the entire script for OP_SUCCESSx opcodes.
    // If any OP_SUCCESSx is encountered (even in unexecuted branches), the whole
    // script succeeds immediately. This must happen before any opcode is executed.
    // Reference: BIP342 Tapscript witness execution (ExecuteWitnessScript).
    if sigversion == SigVersion::Tapscript {
        use crate::activation::IsForkActive;
        use crate::script::flags::SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS;
        let csfs_active = cfg!(feature = "csfs")
            && block_height.is_some_and(|height| {
                crate::activation::ForkActivationTable::from_network(network)
                    .is_fork_active(crate::types::ForkId::Csfs, height)
            });
        let mut pc = 0usize;
        while pc < script.len() {
            let opcode = script[pc];
            // 0xcc stays OP_SUCCESS until the activation table says CSFS is on.
            if is_op_success(opcode)
                && !(csfs_active && opcode == crate::opcodes::OP_CHECKSIGFROMSTACK)
            {
                if flags & SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS != 0 {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::BadOpcode,
                        message: format!("OP_SUCCESSx opcode 0x{opcode:02x} is discouraged").into(),
                    });
                }
                return Ok(true);
            }
            // A push that does not fit ends the scan. Its leftover bytes are not opcodes.
            let Some(next) = tapscript_opcode_end(script, pc) else {
                break;
            };
            pc = next;
        }
        if stack.len() > MAX_STACK_SIZE {
            return Err(make_stack_overflow_error());
        }
        if stack
            .iter()
            .any(|item| item.len() > MAX_SCRIPT_ELEMENT_SIZE)
        {
            return Ok(false);
        }
    }

    // Pre-allocate stack capacity if needed
    if stack.capacity() < 20 {
        stack.reserve(20);
    }
    let mut op_count = 0;

    // Pre-allocate control_stack and altstack to avoid realloc in hot path
    #[cfg(feature = "production")]
    let mut control_stack: Vec<control_flow::ControlBlock> = Vec::with_capacity(4);
    #[cfg(not(feature = "production"))]
    let mut control_stack: Vec<control_flow::ControlBlock> = Vec::new();

    #[cfg(feature = "production")]
    let mut altstack: Vec<StackElement> = Vec::with_capacity(8);
    #[cfg(not(feature = "production"))]
    let mut altstack: Vec<StackElement> = Vec::new();

    // Track OP_CODESEPARATOR position for sighash calculation.
    // pbegincodehash: the script code used for sighash starts
    // from after the last OP_CODESEPARATOR (or from the beginning if none).
    let mut code_separator_pos: usize = 0;
    let mut last_codesep_opcode_pos: u32 = 0xffff_ffff;

    // Use index-based iteration to properly handle push opcodes.
    // The combined stack limit is applied after an opcode finishes, not before it runs.
    let mut i = 0;
    let mut finished_opcode = false;
    while i < script.len() {
        if finished_opcode && stack.len() + altstack.len() > MAX_STACK_SIZE {
            return Err(make_stack_overflow_error());
        }
        finished_opcode = true;
        #[cfg(feature = "production")]
        {
            // Prefetch next cache line(s) ahead for sequential script access
            prefetch::prefetch_ahead(script, i, 64); // Prefetch 64 bytes ahead
        }
        // Use optimized bounds access after length check
        let opcode = {
            #[cfg(feature = "production")]
            {
                unsafe { *script.get_unchecked(i) }
            }
            #[cfg(not(feature = "production"))]
            {
                script[i]
            }
        };

        // Cache in_false_branch state - only recompute when control stack changes
        let in_false_branch = control_flow::in_false_branch(&control_stack);

        // Count non-push opcodes toward op limit (Base/WitnessV0 only; BIP342 Tapscript has no 201-op cap).
        if sigversion != SigVersion::Tapscript && !is_push_opcode(opcode) {
            op_count += 1;
            if op_count > MAX_SCRIPT_OPS {
                return Err(make_operation_limit_error());
            }
        }

        // Handle push opcodes (0x01-0x4b: direct push, OP_PUSHDATA1/2/4)
        if (0x01..=OP_PUSHDATA4).contains(&opcode) {
            let Some(advance) = apply_data_push(script, i, opcode, stack, flags, in_false_branch)?
            else {
                return Ok(false);
            };
            i += advance;
            continue;
        }

        // Check hottest opcodes BEFORE match statement
        // This eliminates dispatch overhead for the most common opcodes (OP_DUP, OP_EQUALVERIFY, OP_HASH160)
        // These opcodes are executed millions of times per block, so avoiding match overhead is critical

        // OP_DUP - duplicate top stack item (VERY HOT - every P2PKH script)
        if opcode == OP_DUP {
            if !in_false_branch {
                if stack.is_empty() {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::InvalidStackOperation,
                        message: "OP_DUP: empty stack".into(),
                    });
                }
                // Optimize OP_DUP - avoid double lookup
                // Use unsafe bounds access after length check (already verified above)
                let len = stack.len();
                #[cfg(feature = "production")]
                {
                    // OPTIMIZATION: Reserve capacity before push to avoid reallocation
                    if stack.capacity() == stack.len() {
                        stack.reserve(1);
                    }
                    // Clone the item using unsafe bounds access (we already checked len > 0)
                    let item = unsafe { stack.get_unchecked(len - 1).clone() };
                    stack.push(item);
                }
                #[cfg(not(feature = "production"))]
                {
                    let item = stack.last().unwrap();
                    stack.push(item.clone());
                }
            }
            i += 1;
            continue;
        }

        // OP_EQUALVERIFY - verify top two stack items are equal (VERY HOT - every P2PKH script)
        if opcode == OP_EQUALVERIFY {
            if !in_false_branch {
                if stack.len() < 2 {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::InvalidStackOperation,
                        message: "OP_EQUALVERIFY: insufficient stack items".into(),
                    });
                }
                let a = stack.pop().unwrap();
                let b = stack.pop().unwrap();
                if a != b {
                    return Ok(false);
                }
            }
            i += 1;
            continue;
        }

        // OP_HASH160 - RIPEMD160(SHA256(x)) (VERY HOT - every P2PKH script)
        if opcode == OP_HASH160 {
            if !in_false_branch && !crypto_ops::op_hash160(stack)? {
                return Ok(false);
            }
            i += 1;
            continue;
        }

        // OP_VERIFY - check if top stack item is non-zero (HOT - many scripts)
        if opcode == OP_VERIFY {
            if !in_false_branch {
                if let Some(item) = stack.pop() {
                    if !cast_to_bool(&item) {
                        return Ok(false);
                    }
                } else {
                    return Ok(false);
                }
            }
            i += 1;
            continue;
        }

        // OP_EQUAL - check if top two stack items are equal (HOT - P2SH scripts)
        if opcode == OP_EQUAL {
            if !in_false_branch {
                if stack.len() < 2 {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::InvalidStackOperation,
                        message: "OP_EQUAL: insufficient stack items".into(),
                    });
                }
                let a = stack.pop().unwrap();
                let b = stack.pop().unwrap();
                stack.push(to_stack_element(script_bool_bytes(a == b)));
            }
            i += 1;
            continue;
        }

        // OP_CHECKSIG / OP_CHECKSIGVERIFY - hot in multisig/P2SH (skip match dispatch)
        // OP_CHECKSIGADD (BIP 342) - Tapscript only; in Base/WitnessV0, 0xba falls through to match
        if opcode == OP_CHECKSIG
            || opcode == OP_CHECKSIGVERIFY
            || (opcode == OP_CHECKSIGADD && sigversion == SigVersion::Tapscript)
        {
            if !in_false_branch {
                let effective_script_code = Some(&script[code_separator_pos..]);
                let (tapscript, codesep) = if sigversion == SigVersion::Tapscript {
                    (Some(script), Some(last_codesep_opcode_pos))
                } else {
                    (None, None)
                };
                let ctx = context::ScriptContext {
                    tx,
                    input_index,
                    prevout_values,
                    prevout_script_pubkeys,
                    block_height,
                    median_time_past,
                    network,
                    sigversion,
                    redeem_script_for_sighash,
                    script_sig_for_sighash,
                    tapscript_for_sighash: tapscript,
                    tapscript_codesep_pos: codesep,
                    taproot_annex_hash,
                    tapscript_validation_weight: weight_cell.as_ref(),
                    #[cfg(feature = "production")]
                    schnorr_collector,
                    precomputed_bip143,
                    #[cfg(feature = "production")]
                    sighash_cache,
                };
                if !execute_opcode_with_context_full(
                    opcode,
                    stack,
                    flags,
                    &ctx,
                    effective_script_code,
                )? {
                    return Ok(false);
                }
            }
            i += 1;
            continue;
        }

        match opcode {
            // OP_0 - push empty array
            OP_0 => {
                if !in_false_branch {
                    stack.push(to_stack_element(&[]));
                }
            }

            // OP_1 to OP_16 - push numbers 1-16
            OP_1_RANGE_START..=OP_1_RANGE_END => {
                if !in_false_branch {
                    let num = opcode - OP_N_BASE;
                    stack.push(to_stack_element(&[num]));
                }
            }

            // OP_1NEGATE - push -1
            OP_1NEGATE => {
                if !in_false_branch {
                    stack.push(to_stack_element(&[0x81])); // -1 in script number encoding
                }
            }

            // OP_NOP - do nothing, execution continues
            OP_NOP => {
                // No operation - this is valid and execution continues
            }

            // OP_VER - causes failure only when executing
            // OP_VER is inside the conditional-execution check,
            // so it only fails in executing branches. Non-executing branches skip it.
            // This differs from truly disabled opcodes (OP_CAT, etc.) which always fail.
            OP_VER => {
                if !in_false_branch {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::DisabledOpcode,
                        message: "OP_VER is disabled".into(),
                    });
                }
            }

            OP_IF => {
                // OP_IF
                if in_false_branch {
                    control_stack.push(control_flow::ControlBlock::If { executing: false });
                    i += 1;
                    continue;
                }

                if stack.is_empty() {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::InvalidStackOperation,
                        message: "OP_IF: empty stack".into(),
                    });
                }
                let condition = pop_if_condition(
                    stack,
                    flags,
                    sigversion,
                    "OP_IF condition must be minimally encoded",
                )?;
                control_stack.push(control_flow::ControlBlock::If {
                    executing: condition,
                });
            }
            OP_NOTIF => {
                // OP_NOTIF
                if in_false_branch {
                    control_stack.push(control_flow::ControlBlock::NotIf { executing: false });
                    i += 1;
                    continue;
                }

                if stack.is_empty() {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::InvalidStackOperation,
                        message: "OP_NOTIF: empty stack".into(),
                    });
                }
                let condition = pop_if_condition(
                    stack,
                    flags,
                    sigversion,
                    "OP_NOTIF condition must be minimally encoded",
                )?;
                control_stack.push(control_flow::ControlBlock::NotIf {
                    executing: !condition,
                });
            }
            OP_ELSE => {
                // OP_ELSE
                if let Some(block) = control_stack.last_mut() {
                    match block {
                        control_flow::ControlBlock::If { executing }
                        | control_flow::ControlBlock::NotIf { executing } => {
                            *executing = !*executing;
                        }
                    }
                } else {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::UnbalancedConditional,
                        message: "OP_ELSE without matching IF/NOTIF".into(),
                    });
                }
            }
            OP_ENDIF => {
                // OP_ENDIF
                if control_stack.pop().is_none() {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::UnbalancedConditional,
                        message: "OP_ENDIF without matching IF/NOTIF".into(),
                    });
                }
            }

            // OP_DUP, OP_EQUALVERIFY, OP_HASH160 are handled BEFORE match statement for performance
            // (moved to avoid dispatch overhead)

            // OP_TOALTSTACK - move top stack item to altstack
            OP_TOALTSTACK => {
                if in_false_branch {
                    i += 1;
                    continue;
                }
                if stack.is_empty() {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::InvalidStackOperation,
                        message: "OP_TOALTSTACK: empty stack".into(),
                    });
                }
                altstack.push(stack.pop().unwrap());
            }
            // OP_FROMALTSTACK - move top altstack item to stack
            OP_FROMALTSTACK => {
                if in_false_branch {
                    i += 1;
                    continue;
                }
                if altstack.is_empty() {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::InvalidAltstackOperation,
                        message: "OP_FROMALTSTACK: empty altstack".into(),
                    });
                }
                stack.push(altstack.pop().unwrap());
            }
            // OP_CODESEPARATOR - update sighash script code start position.
            // Standardness rejects it in a non-segwit script, including an unexecuted branch.
            OP_CODESEPARATOR => {
                if sigversion == SigVersion::Base
                    && flags & crate::script::flags::SCRIPT_VERIFY_CONST_SCRIPTCODE != 0
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::BadOpcode,
                        message: "OP_CODESEPARATOR is non-standard in a non-segwit script".into(),
                    });
                }
                if in_false_branch {
                    i += 1;
                    continue;
                }
                code_separator_pos = i + 1;
                last_codesep_opcode_pos = opcode_position_at_byte(script, i);
            }
            _ => {
                if in_false_branch {
                    if let Some(code) = dead_branch_opcode_error(opcode) {
                        return Err(ConsensusError::ScriptErrorWithCode {
                            code,
                            message: format!(
                                "opcode 0x{opcode:02x} is invalid in an unexecuted branch"
                            )
                            .into(),
                        });
                    }
                    i += 1;
                    continue;
                }

                // For signature opcodes, compute the effective script code for sighash:
                // From the last OP_CODESEPARATOR position to the end of the script.
                // scriptCode = slice from pbegincodehash to pend
                // Only allocate for opcodes that actually use the script code.
                if sigversion != SigVersion::Tapscript
                    && (opcode == OP_CHECKMULTISIG || opcode == OP_CHECKMULTISIGVERIFY)
                {
                    op_count = charge_checkmultisig_pubkeys(stack, op_count)?;
                }
                let subscript_for_sighash = if matches!(
                    opcode,
                    OP_CHECKSIG
                        | OP_CHECKSIGVERIFY
                        | OP_CHECKSIGADD
                        | OP_CHECKMULTISIG
                        | OP_CHECKMULTISIGVERIFY
                ) {
                    Some(&script[code_separator_pos..])
                } else {
                    None
                };
                let effective_script_code = subscript_for_sighash.or(redeem_script_for_sighash);
                let (tapscript, codesep) = if sigversion == SigVersion::Tapscript {
                    (Some(script), Some(last_codesep_opcode_pos))
                } else {
                    (None, None)
                };
                let ctx = context::ScriptContext {
                    tx,
                    input_index,
                    prevout_values,
                    prevout_script_pubkeys,
                    block_height,
                    median_time_past,
                    network,
                    sigversion,
                    redeem_script_for_sighash,
                    script_sig_for_sighash,
                    tapscript_for_sighash: tapscript,
                    tapscript_codesep_pos: codesep,
                    taproot_annex_hash,
                    tapscript_validation_weight: weight_cell.as_ref(),
                    #[cfg(feature = "production")]
                    schnorr_collector,
                    precomputed_bip143,
                    #[cfg(feature = "production")]
                    sighash_cache,
                };
                if !execute_opcode_with_context_full(
                    opcode,
                    stack,
                    flags,
                    &ctx,
                    effective_script_code,
                )? {
                    return Ok(false);
                }
            }
        }
        i += 1;
    }

    if finished_opcode && stack.len() + altstack.len() > MAX_STACK_SIZE {
        return Err(make_stack_overflow_error());
    }

    // Invariant: control stack must be empty — return Err if not (unclosed IF/NOTIF)
    if !control_stack.is_empty() {
        return Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::UnbalancedConditional,
            message: "Unclosed IF/NOTIF block".into(),
        });
    }

    // Witness v0 and tapscript require exactly one truthy stack element.
    // OP_SUCCESS returns above this. Base scripts leave the check to VerifyScript.
    if sigversion == SigVersion::WitnessV0 || sigversion == SigVersion::Tapscript {
        let clean = stack.len() == 1 && cast_to_bool(&stack[0]);
        return Ok(clean);
    }
    Ok(true)
}

/// A script number whose final byte is `0x00` or `0x80` is minimal only when the
/// previous byte's high bit requires that sign byte. `0x80` is negative zero.
pub(crate) fn script_num_is_minimally_encoded(data: &[u8]) -> bool {
    if let Some(&last) = data.last() {
        if last & 0x7f == 0 && (data.len() <= 1 || data[data.len() - 2] & 0x80 == 0) {
            return false;
        }
    }
    true
}

/// Decode a CScriptNum from byte representation.
/// Bitcoin's variable-length signed integer encoding (little-endian, sign bit in MSB of last byte).
/// CScriptNum::set_vch() — BIP62 numeric encoding.
#[cfg_attr(feature = "spec-lock", spec_locked("5.4.5", "DecodeCScriptNum"))]
#[cfg_attr(feature = "spec-lock", blvm_spec_lock::axiom(result >= -549755813887))]
#[cfg_attr(feature = "spec-lock", blvm_spec_lock::ensures(result >= -549755813887))]
#[cfg(feature = "production")]
#[inline(always)]
pub(crate) fn script_num_decode(data: &[u8], max_num_size: usize) -> Result<i64> {
    if data.len() > max_num_size {
        return Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::InvalidStackOperation,
            message: format!(
                "Script number overflow: {} > {} bytes",
                data.len(),
                max_num_size
            )
            .into(),
        });
    }
    if data.is_empty() {
        return Ok(0);
    }

    // Fast paths for common sizes (most script numbers are 1-2 bytes)
    let len = data.len();
    let result = match len {
        1 => {
            let byte = data[0];
            if byte & 0x80 != 0 {
                // Negative: clear sign bit and negate
                -((byte & 0x7f) as i64)
            } else {
                byte as i64
            }
        }
        2 => {
            let byte0 = data[0] as i64;
            let byte1 = data[1] as i64;
            let value = byte0 | (byte1 << 8);
            if byte1 & 0x80 != 0 {
                // Negative: clear sign bit and negate
                -(value & !(0x80i64 << 8))
            } else {
                value
            }
        }
        _ => {
            // General case for 3+ bytes
            let mut result: i64 = 0;
            for (i, &byte) in data.iter().enumerate() {
                result |= (byte as i64) << (8 * i);
            }
            // Check sign bit (MSB of last byte) - safe because len > 0
            let last_idx = len - 1;
            if data[last_idx] & 0x80 != 0 {
                // Negative: clear sign bit and negate
                result &= !(0x80i64 << (8 * last_idx));
                result = -result;
            }
            result
        }
    };

    Ok(result)
}

#[cfg(not(feature = "production"))]
#[inline]
pub(crate) fn script_num_decode(data: &[u8], max_num_size: usize) -> Result<i64> {
    if data.len() > max_num_size {
        return Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::InvalidStackOperation,
            message: format!(
                "Script number overflow: {} > {} bytes",
                data.len(),
                max_num_size
            )
            .into(),
        });
    }
    if data.is_empty() {
        return Ok(0);
    }
    // Little-endian decode
    let mut result: i64 = 0;
    for (i, &byte) in data.iter().enumerate() {
        result |= (byte as i64) << (8 * i);
    }
    // Check sign bit (MSB of last byte)
    if data.last().expect("Data is not empty") & 0x80 != 0 {
        // Negative: clear sign bit and negate
        result &= !(0x80i64 << (8 * (data.len() - 1)));
        result = -result;
    }
    Ok(result)
}

/// Encoded CScriptNum. At most 9 bytes, kept off the heap.
pub(crate) struct ScriptNumBytes {
    buf: [u8; 9],
    len: u8,
}

impl ScriptNumBytes {
    fn new(buf: [u8; 9], len: u8) -> Self {
        Self { buf, len }
    }
}

impl std::ops::Deref for ScriptNumBytes {
    type Target = [u8];
    fn deref(&self) -> &[u8] {
        &self.buf[..self.len as usize]
    }
}

/// Encode an i64 as CScriptNum byte representation.
/// CScriptNum::serialize() — BIP62 numeric encoding.
pub(crate) fn script_num_encode(value: i64) -> ScriptNumBytes {
    match value {
        0 => return ScriptNumBytes::new([0; 9], 0),
        1 => {
            let mut buf = [0u8; 9];
            buf[0] = 1;
            return ScriptNumBytes::new(buf, 1);
        }
        -1 => {
            let mut buf = [0u8; 9];
            buf[0] = 0x81;
            return ScriptNumBytes::new(buf, 1);
        }
        _ => {}
    }

    let neg = value < 0;
    let mut absvalue = if neg {
        (-(value as i128)) as u64
    } else {
        value as u64
    };
    let mut buf = [0u8; 9];
    let mut len = 0u8;
    while absvalue > 0 {
        buf[len as usize] = (absvalue & 0xff) as u8;
        len += 1;
        absvalue >>= 8;
    }
    // If MSB is set, add extra byte for sign
    if buf[len as usize - 1] & 0x80 != 0 {
        buf[len as usize] = if neg { 0x80 } else { 0x00 };
        len += 1;
    } else if neg {
        buf[len as usize - 1] |= 0x80;
    }
    ScriptNumBytes::new(buf, len)
}

/// NOP1 and NOP4–NOP10 stay successful until the upgradable-NOP flag is set.
fn upgradable_nop(flags: u32) -> Result<bool> {
    if flags & flags::SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS != 0 {
        return Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::DiscourageUpgradableNops,
            message: "reserved NOP is discouraged".into(),
        });
    }
    Ok(true)
}

/// Encoding is checked before the no-context multisig pushes a false result.
/// `OP_NOT` must not turn a STRICTENC failure into success.
/// A 0-of-n result is success and Core does not encoding-check those keys.
fn strictenc_nocheck_multisig(stack: &[StackElement], flags: u32) -> Result<()> {
    if flags & 0x02 == 0 || stack.is_empty() {
        return Ok(());
    }
    let n = match script_num_decode(stack.last().unwrap(), 4) {
        Ok(v) if (0..=20).contains(&v) => v as usize,
        _ => return Ok(()),
    };
    if stack.len() < n + 2 {
        return Ok(());
    }
    let n_at = stack.len() - 1;
    let m_at = n_at - n - 1;
    let m = match script_num_decode(&stack[m_at], 4) {
        Ok(v) if v >= 0 && v as usize <= n => v as usize,
        _ => return Ok(()),
    };
    // Core checks encoding only for keys a signature is tested against.
    // A 0-of-n multisig tests none, so an unused pubkey stays valid.
    if m == 0 {
        return Ok(());
    }
    for pubkey in &stack[n_at - n..n_at] {
        crate::script::signature::reject_strictenc_pubkey(flags, pubkey)?;
    }
    if m_at < m {
        return Ok(());
    }
    for signature in &stack[m_at - m..m_at] {
        crate::script::signature::reject_strictenc_signature(flags, signature)?;
    }
    Ok(())
}

/// Pop the CHECKMULTISIG stack (n pubkeys, m signatures, dummy) without verifying.
/// `None` is a script failure. The caller decides the 0-of-n result.
fn pop_nocheck_multisig(stack: &mut Vec<StackElement>) -> Option<usize> {
    if stack.is_empty() {
        return None;
    }
    let n_bytes = stack.pop().unwrap();
    let n = match script_num_decode(&n_bytes, 4) {
        Ok(v) if (0..=20).contains(&v) => v as usize,
        _ => return None,
    };
    if stack.len() < n {
        return None;
    }
    for _ in 0..n {
        stack.pop();
    }
    if stack.is_empty() {
        return None;
    }
    let m_bytes = stack.pop().unwrap();
    let m = match script_num_decode(&m_bytes, 4) {
        Ok(v) if v >= 0 && v as usize <= n => v as usize,
        _ => return None,
    };
    if stack.len() < m {
        return None;
    }
    for _ in 0..m {
        stack.pop();
    }
    if stack.is_empty() {
        return None;
    }
    stack.pop();
    Some(m)
}

/// Execute a single opcode (currently ignores sigversion; accepts it for future compatibility)
#[cfg_attr(feature = "production", inline(always))]
fn execute_opcode(
    opcode: u8,
    stack: &mut Vec<StackElement>,
    flags: u32,
    _sigversion: SigVersion,
) -> Result<bool> {
    match opcode {
        // OP_0 - push empty array
        OP_0 => {
            stack.push(to_stack_element(&[]));
            Ok(true)
        }

        // OP_1 to OP_16 - push numbers 1-16
        OP_1..=OP_16 => {
            let num = opcode - OP_N_BASE;
            stack.push(to_stack_element(&[num]));
            Ok(true)
        }

        // OP_NOP - do nothing, execution continues
        OP_NOP => Ok(true),

        // OP_VER - disabled opcode, always fails
        OP_VER => Ok(false),

        // OP_DEPTH - push stack size
        OP_DEPTH => {
            let depth = stack.len() as i64;
            stack.push(to_stack_element(&script_num_encode(depth)));
            Ok(true)
        }

        // OP_DUP - duplicate top stack item
        OP_DUP => {
            if let Some(item) = stack.last().cloned() {
                stack.push(item);
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_RIPEMD160 - RIPEMD160(x)
        OP_RIPEMD160 => crypto_ops::op_ripemd160(stack),

        // OP_SHA1 - SHA1(x)
        OP_SHA1 => crypto_ops::op_sha1(stack),

        // OP_SHA256 - SHA256(x)
        OP_SHA256 => crypto_ops::op_sha256(stack),

        // OP_HASH160 - RIPEMD160(SHA256(x))
        OP_HASH160 => crypto_ops::op_hash160(stack),

        // OP_HASH256 - SHA256(SHA256(x))
        OP_HASH256 => crypto_ops::op_hash256(stack),

        // OP_EQUAL - check if top two stack items are equal.
        // Pushes [] (empty = false) or [0x01] (true).
        OP_EQUAL => {
            if stack.len() < 2 {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::InvalidStackOperation,
                    message: "OP_EQUAL: insufficient stack items".into(),
                });
            }
            let a = stack.pop().unwrap();
            let b = stack.pop().unwrap();
            stack.push(to_stack_element(if a == b { &[1u8] } else { &[] }));
            Ok(true)
        }

        // OP_EQUALVERIFY - verify top two stack items are equal
        // OP_EQUAL followed by pop if equal
        OP_EQUALVERIFY => {
            if stack.len() < 2 {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::InvalidStackOperation,
                    message: "OP_EQUALVERIFY: insufficient stack items".into(),
                });
            }
            let a = stack.pop().unwrap();
            let b = stack.pop().unwrap();
            let f_equal = a == b;
            // Push result (like OP_EQUAL does)
            stack.push(to_stack_element(script_bool_bytes(f_equal)));
            if f_equal {
                // Pop the true value
                stack.pop();
                Ok(true)
            } else {
                Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::EqualVerify,
                    message: "OP_EQUALVERIFY: stack items not equal".into(),
                })
            }
        }

        // OP_CHECKSIG - verify ECDSA signature (simple path, no tx context)
        OP_CHECKSIG => crypto_ops::op_checksig_simple(stack, flags),

        // OP_CHECKSIGVERIFY - verify ECDSA signature and fail if invalid (simple path)
        OP_CHECKSIGVERIFY => crypto_ops::op_checksigverify_simple(stack, flags),

        // OP_RETURN - always fail (unspendable output)
        OP_RETURN => Ok(false),

        // OP_VERIFY - check if top stack item is non-zero
        OP_VERIFY => {
            if let Some(item) = stack.pop() {
                Ok(cast_to_bool(&item))
            } else {
                Ok(false)
            }
        }

        // OP_CHECKLOCKTIMEVERIFY (BIP65)
        // When SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY flag is not set, behaves as NOP (BIP65 rule).
        // With the flag set but no tx context, fails. Use verify_script_with_context for full CLTV.
        OP_CHECKLOCKTIMEVERIFY => {
            if (flags & flags::SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY) == 0 {
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_CHECKSEQUENCEVERIFY (BIP112)
        // When SCRIPT_VERIFY_CHECKSEQUENCEVERIFY flag is not set, behaves as NOP (BIP112 rule).
        // With the flag set but no tx context, fails. Use verify_script_with_context for full CSV.
        OP_CHECKSEQUENCEVERIFY => {
            if (flags & flags::SCRIPT_VERIFY_CHECKSEQUENCEVERIFY) == 0 {
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_IFDUP - duplicate top stack item if it's non-zero
        OP_IFDUP => {
            if let Some(item) = stack.last().cloned() {
                if cast_to_bool(&item) {
                    stack.push(item);
                }
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_DEPTH - push stack size (duplicate handler removed, using single implementation)
        // OP_DROP - remove top stack item
        OP_DROP => {
            if stack.pop().is_some() {
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_NIP - remove second-to-top stack item
        OP_NIP => {
            if stack.len() >= 2 {
                let top = stack.pop().unwrap();
                stack.pop(); // Remove second-to-top
                stack.push(top);
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_OVER - copy second-to-top stack item to top
        OP_OVER => {
            if stack.len() >= 2 {
                let len = stack.len();
                #[cfg(feature = "production")]
                {
                    // Use proven bounds after length check
                    unsafe {
                        let second = stack.get_unchecked(len - 2);
                        stack.push(second.clone());
                    }
                }
                #[cfg(not(feature = "production"))]
                {
                    let second = stack[stack.len() - 2].clone();
                    stack.push(second);
                }
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_PICK - copy nth stack item to top
        OP_PICK => {
            if let Some(n_bytes) = stack.pop() {
                if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
                    && !script_num_is_minimally_encoded(&n_bytes)
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_PICK: non-minimal script number".into(),
                    });
                }
                // Use script_num_decode to properly handle CScriptNum encoding
                // (empty [] = 0, [0x00] = 0, [0x01] = 1, etc.)
                let n_val = script_num_decode(&n_bytes, 4)?;
                if n_val < 0 || n_val as usize >= stack.len() {
                    return Ok(false);
                }
                let n = n_val as usize;
                let len = stack.len();
                #[cfg(feature = "production")]
                {
                    // Use proven bounds after length check (n_val < stack.len() already checked)
                    unsafe {
                        let item = stack.get_unchecked(len - 1 - n);
                        stack.push(item.clone());
                    }
                }
                #[cfg(not(feature = "production"))]
                {
                    let item = stack[stack.len() - 1 - n].clone();
                    stack.push(item);
                }
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_ROLL - move nth stack item to top
        OP_ROLL => {
            if let Some(n_bytes) = stack.pop() {
                if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
                    && !script_num_is_minimally_encoded(&n_bytes)
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_ROLL: non-minimal script number".into(),
                    });
                }
                // Use script_num_decode to properly handle CScriptNum encoding
                // (empty [] = 0, which is a valid no-op roll)
                let n_val = script_num_decode(&n_bytes, 4)?;
                if n_val < 0 || n_val as usize >= stack.len() {
                    return Ok(false);
                }
                let n = n_val as usize;
                let len = stack.len();
                #[cfg(feature = "production")]
                {
                    // Use proven bounds after length check (n_val < stack.len() already checked)
                    let idx = len - 1 - n;
                    let item = stack.remove(idx);
                    stack.push(item);
                }
                #[cfg(not(feature = "production"))]
                {
                    let item = stack.remove(stack.len() - 1 - n);
                    stack.push(item);
                }
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_ROT - rotate top 3 stack items
        OP_ROT => {
            if stack.len() >= 3 {
                let top = stack.pop().unwrap();
                let second = stack.pop().unwrap();
                let third = stack.pop().unwrap();
                stack.push(second);
                stack.push(top);
                stack.push(third);
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_SWAP - swap top 2 stack items
        OP_SWAP => {
            if stack.len() >= 2 {
                let top = stack.pop().unwrap();
                let second = stack.pop().unwrap();
                stack.push(top);
                stack.push(second);
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_TUCK - copy top stack item to before second-to-top
        OP_TUCK => {
            if stack.len() >= 2 {
                let top = stack.pop().unwrap();
                let second = stack.pop().unwrap();
                stack.push(top.clone());
                stack.push(second);
                stack.push(top);
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_2DROP - remove top 2 stack items
        OP_2DROP => {
            if stack.len() >= 2 {
                stack.pop();
                stack.pop();
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_2DUP - duplicate top 2 stack items
        OP_2DUP => {
            if stack.len() >= 2 {
                let top = stack[stack.len() - 1].clone();
                let second = stack[stack.len() - 2].clone();
                stack.push(second);
                stack.push(top);
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_3DUP - duplicate top 3 stack items
        OP_3DUP => {
            if stack.len() >= 3 {
                let top = stack[stack.len() - 1].clone();
                let second = stack[stack.len() - 2].clone();
                let third = stack[stack.len() - 3].clone();
                stack.push(third);
                stack.push(second);
                stack.push(top);
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_2OVER - copy second pair of stack items to top
        OP_2OVER => {
            if stack.len() >= 4 {
                let fourth = stack[stack.len() - 4].clone();
                let third = stack[stack.len() - 3].clone();
                stack.push(fourth);
                stack.push(third);
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_2ROT - move the pair at positions 5 and 6 from top to top.
        // Before: [... a b c d e f] (f=top). After: [... c d e f a b] (b=top).
        OP_2ROT => {
            if stack.len() >= 6 {
                // Remove from bottom-most of the pair first (index 0 = 6th from top).
                let sixth = stack.remove(stack.len() - 6); // a
                // After first remove the stack shrank; 5th from original top is now at index 0.
                let fifth = stack.remove(stack.len() - 5); // b
                // Push in original order: sixth (a) below, fifth (b) on top.
                stack.push(sixth);
                stack.push(fifth);
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_2SWAP - swap second pair of stack items
        OP_2SWAP => {
            if stack.len() >= 4 {
                let top = stack.pop().unwrap();
                let second = stack.pop().unwrap();
                let third = stack.pop().unwrap();
                let fourth = stack.pop().unwrap();
                stack.push(second);
                stack.push(top);
                stack.push(fourth);
                stack.push(third);
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_SIZE - push size of top stack item
        // OP_SIZE - push the byte length of top stack item (does NOT pop)
        OP_SIZE => {
            if let Some(item) = stack.last() {
                let size = item.len() as i64;
                stack.push(to_stack_element(&script_num_encode(size)));
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // --- Arithmetic opcodes ---
        // All use CScriptNum encoding (max 4 bytes by default)

        // OP_1ADD - increment top by 1
        OP_1ADD => {
            if let Some(item) = stack.pop() {
                if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
                    && !script_num_is_minimally_encoded(&item)
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_1ADD: non-minimal script number".into(),
                    });
                }
                let a = script_num_decode(&item, 4)?;
                stack.push(to_stack_element(&script_num_encode(a + 1)));
                Ok(true)
            } else {
                Ok(false)
            }
        }
        // OP_1SUB - decrement top by 1
        OP_1SUB => {
            if let Some(item) = stack.pop() {
                if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
                    && !script_num_is_minimally_encoded(&item)
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_1SUB: non-minimal script number".into(),
                    });
                }
                let a = script_num_decode(&item, 4)?;
                stack.push(to_stack_element(&script_num_encode(a - 1)));
                Ok(true)
            } else {
                Ok(false)
            }
        }
        // OP_2MUL - DISABLED
        OP_2MUL => Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::DisabledOpcode,
            message: "OP_2MUL is disabled".into(),
        }),
        // OP_2DIV - DISABLED
        OP_2DIV => Err(ConsensusError::ScriptErrorWithCode {
            code: ScriptErrorCode::DisabledOpcode,
            message: "OP_2DIV is disabled".into(),
        }),
        // OP_NEGATE - negate top
        OP_NEGATE => {
            if let Some(item) = stack.pop() {
                if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
                    && !script_num_is_minimally_encoded(&item)
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_NEGATE: non-minimal script number".into(),
                    });
                }
                let a = script_num_decode(&item, 4)?;
                stack.push(to_stack_element(&script_num_encode(-a)));
                Ok(true)
            } else {
                Ok(false)
            }
        }
        // OP_ABS - absolute value
        OP_ABS => {
            if let Some(item) = stack.pop() {
                if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
                    && !script_num_is_minimally_encoded(&item)
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_ABS: non-minimal script number".into(),
                    });
                }
                let a = script_num_decode(&item, 4)?;
                stack.push(to_stack_element(&script_num_encode(a.abs())));
                Ok(true)
            } else {
                Ok(false)
            }
        }
        // OP_NOT - logical NOT: 0 → 1, nonzero → 0
        OP_NOT => {
            if let Some(item) = stack.pop() {
                if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
                    && !script_num_is_minimally_encoded(&item)
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_NOT: non-minimal script number".into(),
                    });
                }
                let a = script_num_decode(&item, 4)?;
                stack.push(to_stack_element(&script_num_encode(if a == 0 {
                    1
                } else {
                    0
                })));
                Ok(true)
            } else {
                Ok(false)
            }
        }
        // OP_0NOTEQUAL - 0 → 0, nonzero → 1
        OP_0NOTEQUAL => {
            if let Some(item) = stack.pop() {
                if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
                    && !script_num_is_minimally_encoded(&item)
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_0NOTEQUAL: non-minimal script number".into(),
                    });
                }
                let a = script_num_decode(&item, 4)?;
                stack.push(to_stack_element(&script_num_encode(if a != 0 {
                    1
                } else {
                    0
                })));
                Ok(true)
            } else {
                Ok(false)
            }
        }
        OP_ADD => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 2 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_ADD: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_add(stack)
        }
        OP_SUB => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 2 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_SUB: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_sub(stack)
        }
        OP_MUL => arithmetic::op_mul_disabled(),
        OP_DIV => arithmetic::op_div_disabled(),
        OP_MOD => arithmetic::op_mod_disabled(),
        OP_LSHIFT => arithmetic::op_lshift_disabled(),
        OP_RSHIFT => arithmetic::op_rshift_disabled(),
        OP_BOOLAND => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 2 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_BOOLAND: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_booland(stack)
        }
        OP_BOOLOR => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 2 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_BOOLOR: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_boolor(stack)
        }
        OP_NUMEQUAL => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 2 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_NUMEQUAL: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_numequal(stack)
        }
        OP_NUMEQUALVERIFY => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 2 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_NUMEQUALVERIFY: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_numequalverify(stack)
        }
        OP_NUMNOTEQUAL => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 2 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_NUMNOTEQUAL: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_numnotequal(stack)
        }
        OP_LESSTHAN => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 2 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_LESSTHAN: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_lessthan(stack)
        }
        OP_GREATERTHAN => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 2 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_GREATERTHAN: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_greaterthan(stack)
        }
        OP_LESSTHANOREQUAL => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 2 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_LESSTHANOREQUAL: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_lessthanorequal(stack)
        }
        OP_GREATERTHANOREQUAL => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 2 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_GREATERTHANOREQUAL: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_greaterthanorequal(stack)
        }
        OP_MIN => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 2 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_MIN: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_min(stack)
        }
        OP_MAX => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 2 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_MAX: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_max(stack)
        }
        OP_WITHIN => {
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0 && stack.len() >= 3 {
                let len = stack.len();
                if !script_num_is_minimally_encoded(&stack[len - 1])
                    || !script_num_is_minimally_encoded(&stack[len - 2])
                    || !script_num_is_minimally_encoded(&stack[len - 3])
                {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_WITHIN: non-minimal script number".into(),
                    });
                }
            }
            arithmetic::op_within(stack)
        }

        // OP_CODESEPARATOR - marks position for sighash (no-op in execute_opcode)
        OP_CODESEPARATOR => Ok(true),

        // OP_NOP1 and OP_NOP5-OP_NOP10. OP_NOP4 is OP_CHECKTEMPLATEVERIFY.
        OP_NOP1 | OP_NOP5..=OP_NOP10 => upgradable_nop(flags),

        // OP_CHECKTEMPLATEVERIFY (NOP4 / BIP 119)
        // Treated as a reserved NOP unless the CTV feature is on and its flag is set.
        OP_CHECKTEMPLATEVERIFY => {
            #[cfg(feature = "ctv")]
            if flags & flags::SCRIPT_VERIFY_DEFAULT_CHECK_TEMPLATE_VERIFY_HASH != 0 {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::TxInvalid,
                    message: "OP_CHECKTEMPLATEVERIFY requires transaction context".into(),
                });
            }
            upgradable_nop(flags)
        }

        // Disabled string opcodes - must return error per consensus
        OP_DISABLED_STRING_RANGE_START..=OP_DISABLED_STRING_RANGE_END
        | OP_DISABLED_BITWISE_RANGE_START..=OP_DISABLED_BITWISE_RANGE_END => {
            Err(ConsensusError::ScriptErrorWithCode {
                code: ScriptErrorCode::DisabledOpcode,
                message: format!("Disabled opcode 0x{opcode:02x}").into(),
            })
        }

        // OP_1NEGATE - push -1 onto stack
        OP_1NEGATE => {
            stack.push(to_stack_element(&[0x81]));
            Ok(true)
        }

        // OP_CHECKMULTISIG - verify m-of-n multisig without transaction context.
        // Handles stack mechanics correctly for all cases; succeeds only when m=0
        // (no signatures to verify). Vectors requiring real ECDSA verification need
        // verify_script_with_context_full.
        OP_CHECKMULTISIG => {
            strictenc_nocheck_multisig(stack, flags)?;
            let Some(m) = pop_nocheck_multisig(stack) else {
                return Ok(false);
            };
            // Without tx context only 0-sig multisig can succeed
            stack.push(to_stack_element(script_bool_bytes(m == 0)));
            Ok(true)
        }

        // OP_CHECKMULTISIGVERIFY - CHECKMULTISIG then VERIFY
        OP_CHECKMULTISIGVERIFY => {
            strictenc_nocheck_multisig(stack, flags)?;
            let Some(m) = pop_nocheck_multisig(stack) else {
                return Ok(false);
            };
            Ok(m == 0)
        }

        // Unknown opcode
        _ => Ok(false),
    }
}

/// Three data pushes: signature, pubkey, and a 25-byte P2PKH redeem.
/// Borrows `script_sig`. Numeric opcodes are not this pattern.
#[inline(always)]
fn parse_p2sh_p2pkh_pushes(script_sig: &[u8]) -> Option<(&[u8], &[u8], &[u8])> {
    let mut i = 0;
    let (adv1, s_start, s_end) = parse_one_data_push(script_sig, i)?;
    i += adv1;
    if i >= script_sig.len() {
        return None;
    }
    let (adv2, p_start, p_end) = parse_one_data_push(script_sig, i)?;
    i += adv2;
    if i >= script_sig.len() {
        return None;
    }
    let (adv3, r_start, r_end) = parse_one_data_push(script_sig, i)?;
    i += adv3;
    if i != script_sig.len() {
        return None;
    }
    let sig = &script_sig[s_start..s_end];
    let pubkey = &script_sig[p_start..p_end];
    let redeem = &script_sig[r_start..r_end];
    if sig.is_empty() || redeem.len() != 25 {
        return None;
    }
    if redeem[0] != OP_DUP
        || redeem[1] != OP_HASH160
        || redeem[2] != PUSH_20_BYTES
        || redeem[23] != OP_EQUALVERIFY
        || redeem[24] != OP_CHECKSIG
    {
        return None;
    }
    Some((sig, pubkey, redeem))
}

/// Two data pushes: a non-empty signature and a canonical P2PK redeem.
/// Borrows `script_sig`. Numeric opcodes are not this pattern.
#[inline(always)]
fn parse_p2sh_p2pk_pushes(script_sig: &[u8]) -> Option<(&[u8], &[u8], &[u8])> {
    let mut i = 0;
    let (adv1, s_start, s_end) = parse_one_data_push(script_sig, i)?;
    i += adv1;
    if i >= script_sig.len() {
        return None;
    }
    let (adv2, r_start, r_end) = parse_one_data_push(script_sig, i)?;
    i += adv2;
    if i != script_sig.len() {
        return None;
    }
    let sig = &script_sig[s_start..s_end];
    let redeem = &script_sig[r_start..r_end];
    if sig.is_empty() {
        return None;
    }
    let pubkey = canonical_p2pk_pubkey(redeem)?;
    Some((sig, pubkey, redeem))
}

/// Parse P2SH-P2PKH scriptSig for batch sighash precompute. Zero-allocation.
/// script_sig = [sig, pubkey, redeem] where redeem is P2PKH (25 bytes).
/// Returns (sighash_byte, redeem_slice) or None. Pub(crate) for block.rs.
#[cfg(feature = "production")]
#[inline(always)]
pub(crate) fn parse_p2sh_p2pkh_for_precompute(script_sig: &[u8]) -> Option<(u8, &[u8])> {
    let (sig, _pubkey, redeem) = parse_p2sh_p2pkh_pushes(script_sig)?;
    Some((sig[sig.len() - 1], redeem))
}

/// Zero-allocation parser for P2PKH scriptSig: exactly two data pushes (`signature`, then `pubkey`).
/// Returns (sig_slice, pubkey_slice) borrowing into script_sig, or None if invalid.
/// Pub(crate) for batch sighash precompute in block.rs.
#[inline(always)]
pub(crate) fn parse_p2pkh_script_sig(script_sig: &[u8]) -> Option<(&[u8], &[u8])> {
    let mut i = 0;
    let (adv1, s_start, s_end) = parse_one_data_push(script_sig, i)?;
    i += adv1;
    if i >= script_sig.len() {
        return None;
    }
    let (adv2, p_start, p_end) = parse_one_data_push(script_sig, i)?;
    i += adv2;
    if i != script_sig.len() {
        return None;
    }
    Some((&script_sig[s_start..s_end], &script_sig[p_start..p_end]))
}

/// Parse P2PK scriptSig as single push (signature). Returns sig slice or None.
/// Used for P2PK pre-extraction in producer.
pub(crate) fn parse_p2pk_script_sig(script_sig: &[u8]) -> Option<&[u8]> {
    let (advance, data_start, data_end) = parse_one_data_push(script_sig, 0)?;
    if advance != script_sig.len() {
        return None;
    }
    Some(&script_sig[data_start..data_end])
}

/// Parse a single push opcode at `i`, return (advance, data_start, data_end). Rejects OP_0 and numerics.
fn parse_one_data_push(script: &[u8], i: usize) -> Option<(usize, usize, usize)> {
    if i >= script.len() {
        return None;
    }
    let opcode = script[i];
    let (advance, data_start, data_end) = if opcode == OP_0 {
        return None;
    } else if opcode <= 0x4b {
        let len = opcode as usize;
        if i + 1 + len > script.len() {
            return None;
        }
        (1 + len, i + 1, i + 1 + len)
    } else if opcode == OP_PUSHDATA1 {
        if i + 1 >= script.len() {
            return None;
        }
        let len = script[i + 1] as usize;
        if i + 2 + len > script.len() {
            return None;
        }
        (2 + len, i + 2, i + 2 + len)
    } else if opcode == OP_PUSHDATA2 {
        if i + 2 >= script.len() {
            return None;
        }
        let len = u16::from_le_bytes([script[i + 1], script[i + 2]]) as usize;
        if i + 3 + len > script.len() {
            return None;
        }
        (3 + len, i + 3, i + 3 + len)
    } else if opcode == OP_PUSHDATA4 {
        if i + 4 >= script.len() {
            return None;
        }
        let len = u32::from_le_bytes([script[i + 1], script[i + 2], script[i + 3], script[i + 4]])
            as usize;
        if i + 5 + len > script.len() {
            return None;
        }
        (5 + len, i + 5, i + 5 + len)
    } else {
        return None;
    };
    Some((advance, data_start, data_end))
}

/// P2SH Push-Only Validation (Orange Paper 5.2.1).
/// Returns true if script_sig contains only push opcodes (valid), false otherwise (invalid).
#[cfg_attr(feature = "spec-lock", spec_locked("5.2.1", "P2SHPushOnlyCheck"))]
pub fn p2sh_push_only_check(script_sig: &[u8]) -> bool {
    let mut i = 0;
    while i < script_sig.len() {
        let opcode = script_sig[i];
        if !is_push_opcode(opcode) {
            return false;
        }
        if opcode == OP_0 || opcode == OP_1NEGATE || (OP_1..=OP_16).contains(&opcode) {
            i += 1;
            continue;
        }
        let Some((advance, _, _)) = parse_one_data_push(script_sig, i) else {
            return false;
        };
        i += advance;
    }
    true
}

/// Copies each push. Spec-lock mutation coverage extracts this body; the live check does not call it.
#[allow(dead_code)]
fn parse_script_sig_push_only(script_sig: &[u8]) -> Option<Vec<StackElement>> {
    let mut out = Vec::new();
    let mut i = 0;
    while i < script_sig.len() {
        let opcode = script_sig[i];
        if !is_push_opcode(opcode) {
            return None;
        }
        if opcode == OP_0 {
            out.push(to_stack_element(&[]));
            i += 1;
            continue;
        }
        if opcode == OP_1NEGATE || (OP_1..=OP_16).contains(&opcode) {
            // Numeric pushes. OP_RESERVED sits between OP_1NEGATE and OP_1 and is not one of them.
            out.push(to_stack_element(&script_num_encode(
                script_num_from_opcode(opcode),
            )));
            i += 1;
            continue;
        }
        let (advance, data_start, data_end) = parse_one_data_push(script_sig, i)?;
        out.push(to_stack_element(&script_sig[data_start..data_end]));
        i += advance;
    }
    Some(out)
}

/// One scriptSig push. Data and `OP_0` borrow the script. A numeric opcode keeps its
/// one-byte encoding beside the slice, because that encoding is not in the script.
enum BorrowedPush<'a> {
    Borrowed(&'a [u8]),
    Number(ScriptNumBytes),
}

impl AsRef<[u8]> for BorrowedPush<'_> {
    fn as_ref(&self) -> &[u8] {
        match self {
            BorrowedPush::Borrowed(bytes) => bytes,
            BorrowedPush::Number(encoded) => &encoded[..],
        }
    }
}

/// Push-only script as borrowed values. `OP_0` is an empty slice. `OP_RESERVED` is not a push.
fn parse_borrowed_pushes(script_sig: &[u8]) -> Option<Vec<BorrowedPush<'_>>> {
    let mut out = Vec::new();
    let mut i = 0;
    while i < script_sig.len() {
        let opcode = script_sig[i];
        if !is_push_opcode(opcode) {
            return None;
        }
        if opcode == OP_0 {
            out.push(BorrowedPush::Borrowed(&[]));
            i += 1;
            continue;
        }
        if opcode == OP_1NEGATE || (OP_1..=OP_16).contains(&opcode) {
            out.push(BorrowedPush::Number(script_num_encode(
                script_num_from_opcode(opcode),
            )));
            i += 1;
            continue;
        }
        let (advance, data_start, data_end) = parse_one_data_push(script_sig, i)?;
        out.push(BorrowedPush::Borrowed(&script_sig[data_start..data_end]));
        i += advance;
    }
    Some(out)
}

/// Stack items are bottom-to-top, before the script pushes `m`, the keys, and `n`.
///
/// `OP_CHECKMULTISIG` pops exactly `m` signatures from the top and the item
/// under them as the dummy. `exact` is the witness rule: the stack must be
/// that dummy plus those signatures and nothing underneath.
fn checkmultisig_window<T: AsRef<[u8]>>(
    items: &[T],
    m: u8,
    exact: bool,
) -> Option<(&[u8], Vec<&[u8]>)> {
    let m = m as usize;
    let need = m + 1;
    if m == 0 || items.len() < need {
        return None;
    }
    if exact && items.len() != need {
        return None;
    }
    let sig_at = items.len() - m;
    let dummy = items[sig_at - 1].as_ref();
    let signatures = items[sig_at..].iter().map(|item| item.as_ref()).collect();
    Some((dummy, signatures))
}

/// Parse redeem script as `OP_m <pubkeys> OP_n OP_CHECKMULTISIG`.
///
/// `m` is the required signature count. `n` is the pubkey count. Each key is a
/// `PUSH_33_BYTES` or `PUSH_65_BYTES` push. A direct push of 2, 3, or 4 bytes
/// is not a key.
///
/// Returns `(m, n, pubkey_slices)` or `None` if the format doesn't match.
fn parse_redeem_multisig(redeem: &[u8]) -> Option<(u8, u8, Vec<&[u8]>)> {
    if redeem.len() < 4 {
        return None;
    }
    // Trailer: OP_n OP_CHECKMULTISIG
    if redeem[redeem.len() - 1] != OP_CHECKMULTISIG {
        return None;
    }
    let n_op = redeem[redeem.len() - 2];
    if !(OP_1..=OP_16).contains(&n_op) {
        return None;
    }
    let n = (n_op - OP_1 + 1) as usize;
    let m_op = redeem[0];
    if !(OP_1..=OP_16).contains(&m_op) {
        return None;
    }
    let m = m_op - OP_1 + 1;
    if (m as usize) > n || m == 0 {
        return None;
    }
    let mut i = 1;
    let mut pubkeys = Vec::with_capacity(n);
    for _ in 0..n {
        if i >= redeem.len().saturating_sub(2) {
            return None;
        }
        let first = redeem[i];
        let (pk_start, pk_len) = if first == PUSH_33_BYTES {
            (i + 1, PUSH_33_BYTES as usize)
        } else if first == PUSH_65_BYTES {
            (i + 1, PUSH_65_BYTES as usize)
        } else {
            return None;
        };
        if pk_start + pk_len > redeem.len().saturating_sub(2) {
            return None;
        }
        let pk = &redeem[pk_start..pk_start + pk_len];
        let hdr = pk[0];
        if !(hdr == 0x02 || hdr == 0x03 || hdr == 0x04) {
            return None;
        }
        if (hdr == 0x02 || hdr == 0x03) && pk_len != 33 {
            return None;
        }
        if hdr == 0x04 && pk_len != 65 {
            return None;
        }
        pubkeys.push(pk);
        i = pk_start + pk_len;
    }
    // Must land exactly on OP_n OP_CHECKMULTISIG.
    if i != redeem.len() - 2 {
        return None;
    }
    Some((m, n as u8, pubkeys))
}

#[cfg(test)]
mod parse_redeem_multisig_tests {
    use super::*;

    #[test]
    fn accepts_push_encoded_compressed_2of3() {
        // Standard: OP_m <pks> OP_n OP_CHECKMULTISIG  →  2-of-3
        let mut redeem = vec![OP_2];
        for i in 0..3u8 {
            redeem.push(PUSH_33_BYTES);
            let mut pk = [0u8; 33];
            pk[0] = 0x02;
            pk[1] = i + 1;
            redeem.extend_from_slice(&pk);
        }
        redeem.push(OP_3);
        redeem.push(OP_CHECKMULTISIG);
        let (m, n, pks) = parse_redeem_multisig(&redeem).expect("push-encoded redeem");
        assert_eq!(m, 2);
        assert_eq!(n, 3);
        assert_eq!(pks.len(), 3);
        assert_eq!(pks[0][0], 0x02);
    }

    #[test]
    fn rejects_raw_key_without_a_push_opcode() {
        let mut compressed = vec![OP_1];
        let mut pk33 = [0u8; PUSH_33_BYTES as usize];
        pk33[0] = 3;
        compressed.extend_from_slice(&pk33);
        compressed.push(OP_1);
        compressed.push(OP_CHECKMULTISIG);
        assert!(parse_redeem_multisig(&compressed).is_none());

        let mut uncompressed = vec![OP_1];
        let pk65 = [4u8; PUSH_65_BYTES as usize];
        uncompressed.extend_from_slice(&pk65);
        uncompressed.push(OP_1);
        uncompressed.push(OP_CHECKMULTISIG);
        assert!(parse_redeem_multisig(&uncompressed).is_none());
    }

    #[test]
    fn rejects_trailing_opcodes() {
        let mut redeem = vec![OP_1, PUSH_33_BYTES];
        let mut pk = [0u8; 33];
        pk[0] = 0x02;
        redeem.extend_from_slice(&pk);
        redeem.push(OP_1);
        redeem.push(OP_CHECKMULTISIG);
        redeem.push(OP_DROP);
        assert!(parse_redeem_multisig(&redeem).is_none());
    }

    #[test]
    fn checkmultisig_window_is_the_top_m_signatures() {
        let items = vec![
            to_stack_element(&[]),
            to_stack_element(&[0x11]),
            to_stack_element(&[0x22]),
        ];
        let (dummy, sigs) = checkmultisig_window(&items, 1, false).expect("legacy window");
        assert_eq!(dummy, &[0x11]);
        assert_eq!(sigs, vec![&[0x22][..]]);
        assert!(checkmultisig_window(&items, 1, true).is_none());

        let exact = vec![to_stack_element(&[]), to_stack_element(&[0x22])];
        let (dummy, sigs) = checkmultisig_window(&exact, 1, true).expect("witness window");
        assert!(dummy.is_empty());
        assert_eq!(sigs, vec![&[0x22][..]]);
        assert!(checkmultisig_window(&exact, 2, false).is_none());
    }

    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
    #[test]
    fn p2sh_multisig_fast_path_rejects_a_signature_above_the_window() {
        use crate::script::flags::{
            SCRIPT_VERIFY_DERSIG, SCRIPT_VERIFY_P2SH, SCRIPT_VERIFY_WITNESS,
        };
        use crate::transaction_hash::compute_legacy_sighash_nocache;
        use crate::types::{Network, OutPoint, Transaction, TransactionInput, TransactionOutput};
        use secp256k1::{Message, PublicKey, Secp256k1, SecretKey};

        let secp = Secp256k1::new();
        let sk = SecretKey::from_slice(&[0x41; 32]).expect("secret");
        let pk1 = PublicKey::from_secret_key(&secp, &sk).serialize();
        let pk2 =
            PublicKey::from_secret_key(&secp, &SecretKey::from_slice(&[0x42; 32]).expect("secret"))
                .serialize();
        let mut redeem = vec![OP_1, PUSH_33_BYTES];
        redeem.extend_from_slice(&pk1);
        redeem.push(PUSH_33_BYTES);
        redeem.extend_from_slice(&pk2);
        redeem.push(OP_2);
        redeem.push(OP_CHECKMULTISIG);

        let hash160 = Ripemd160::digest(OptimizedSha256::new().hash(&redeem));
        let mut script_pubkey = vec![OP_HASH160, PUSH_20_BYTES];
        script_pubkey.extend_from_slice(&hash160);
        script_pubkey.push(OP_EQUAL);

        let mut tx = Transaction {
            version: 1,
            inputs: vec![TransactionInput {
                prevout: OutPoint {
                    hash: [0x11; 32],
                    index: 0,
                },
                script_sig: Vec::new().into(),
                sequence: 0xffff_ffff,
            }]
            .into(),
            outputs: vec![TransactionOutput {
                value: 1_000,
                script_pubkey: vec![OP_1].into(),
            }]
            .into(),
            lock_time: 0,
        };
        let sighash = compute_legacy_sighash_nocache(&tx, 0, &redeem, 0x01);
        let mut sig = secp
            .sign_ecdsa(&Message::from_digest_slice(&sighash).expect("digest"), &sk)
            .serialize_der()
            .to_vec();
        sig.push(0x01);

        let mut exact = vec![OP_0];
        exact.push(sig.len() as u8);
        exact.extend_from_slice(&sig);
        exact.push(redeem.len() as u8);
        exact.extend_from_slice(&redeem);
        tx.inputs[0].script_sig = exact.into();

        // No NULLDUMMY: rejection has to come from the signature window itself.
        let flags = SCRIPT_VERIFY_P2SH | SCRIPT_VERIFY_WITNESS | SCRIPT_VERIFY_DERSIG;
        let values = [50_000_000i64];
        let prevouts: [&[u8]; 1] = [&script_pubkey];
        let height = Some(crate::constants::BIP147_ACTIVATION_MAINNET);
        let verdict = |tx: &Transaction| {
            try_verify_p2sh_multisig_fast_path(
                &tx.inputs[0].script_sig,
                &script_pubkey,
                flags,
                tx,
                0,
                &values,
                &prevouts,
                height,
                Network::Mainnet,
                None,
                None,
            )
        };
        assert_eq!(
            verdict(&tx).expect("handled").expect("no script error"),
            true,
            "dummy plus one signature"
        );

        let garbage = [0x22u8; 9];
        let mut extra = vec![OP_0];
        extra.push(sig.len() as u8);
        extra.extend_from_slice(&sig);
        extra.push(garbage.len() as u8);
        extra.extend_from_slice(&garbage);
        extra.push(redeem.len() as u8);
        extra.extend_from_slice(&redeem);
        tx.inputs[0].script_sig = extra.into();
        assert!(
            !matches!(verdict(&tx), Some(Ok(true))),
            "a non-matching push above the real signature is not in the window"
        );
    }

    /// Regression: P2WSH-in-P2SH (wit.len()==2) must not be claimed as nested P2WPKH.
    /// Mainnet height 497110 tx330 failed when the dens path returned Ok(false) instead of None.
    #[cfg(feature = "production")]
    #[test]
    fn nested_p2wsh_not_claimed_as_p2wpkh_in_p2sh() {
        use crate::types::{OutPoint, Transaction, TransactionInput};
        // scriptSig = push(34) ‖ OP_0 ‖ PUSH_32 ‖ <32-byte program>  (nested P2WSH)
        let mut program = [0u8; 32];
        program[0] = 0x50;
        let mut script_sig = vec![34u8, OP_0, PUSH_32_BYTES];
        script_sig.extend_from_slice(&program);
        let script_pubkey = {
            let h = Ripemd160::digest(OptimizedSha256::new().hash(&script_sig[1..]));
            let mut spk = vec![OP_HASH160, PUSH_20_BYTES];
            spk.extend_from_slice(&h);
            spk.push(OP_EQUAL);
            spk
        };
        // Minimal fake witness [sig, witnessScript] — shape only; fast path must return None
        // before verifying (redeem is not 22-byte P2WPKH).
        let witness: crate::witness::Witness = vec![vec![0u8; 72], vec![OP_1, OP_1]];
        let tx = Transaction {
            version: 1,
            inputs: vec![TransactionInput {
                prevout: OutPoint {
                    hash: [0u8; 32],
                    index: 0,
                },
                sequence: 0xffff_ffff,
                script_sig: script_sig.clone(),
            }]
            .into(),
            outputs: vec![].into(),
            lock_time: 0,
        };
        let result = try_verify_p2wpkh_in_p2sh_fast_path(
            &script_sig,
            &script_pubkey,
            &witness,
            0x01, // P2SH
            &tx,
            0,
            &[0i64],
            &[],
            Some(497_110),
            crate::types::Network::Mainnet,
            None,
            #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
            None,
        );
        assert!(
            result.is_none(),
            "nested P2WSH must fall through, got {:?}",
            result
        );
    }
}

/// Map OP_1NEGATE..OP_16 to numeric value for script_num_to_bytes
fn script_num_from_opcode(opcode: u8) -> i64 {
    match opcode {
        OP_1NEGATE => -1,
        OP_1 => 1,
        OP_2 => 2,
        OP_3 => 3,
        OP_4 => 4,
        OP_5 => 5,
        OP_6 => 6,
        OP_7 => 7,
        OP_8 => 8,
        OP_9 => 9,
        OP_10 => 10,
        OP_11 => 11,
        OP_12 => 12,
        OP_13 => 13,
        OP_14 => 14,
        OP_15 => 15,
        OP_16 => 16,
        _ => 0,
    }
}

/// Serialize data as a Bitcoin push operation: `push_opcode` followed by `data` bytes.
/// This creates the byte pattern that FindAndDelete searches for.
/// Push data to script (BIP62 encoding rules).
#[inline]
fn redeem_push_is_canonical(script_sig: &[u8], redeem: &[u8]) -> bool {
    let len = redeem.len();
    if len < 76 {
        return script_sig.len() == len + 1
            && script_sig[0] as usize == len
            && &script_sig[1..] == redeem;
    }
    script_sig == serialize_push_data(redeem).as_slice()
}

pub(crate) fn serialize_push_data(data: &[u8]) -> Vec<u8> {
    let len = data.len();
    let mut result = Vec::with_capacity(len + 5);
    if len < 76 {
        result.push(len as u8);
    } else if len < 256 {
        result.push(OP_PUSHDATA1);
        result.push(len as u8);
    } else if len < 65536 {
        result.push(OP_PUSHDATA2);
        result.push((len & 0xff) as u8);
        result.push(((len >> 8) & 0xff) as u8);
    } else {
        result.push(OP_PUSHDATA4);
        result.push((len & 0xff) as u8);
        result.push(((len >> 8) & 0xff) as u8);
        result.push(((len >> 16) & 0xff) as u8);
        result.push(((len >> 24) & 0xff) as u8);
    }
    result.extend_from_slice(data);
    result
}

/// Push encoding for a FindAndDelete probe. Direct pushes stay on the stack.
fn with_push_pattern<R>(data: &[u8], f: impl FnOnce(&[u8]) -> R) -> R {
    let len = data.len();
    if len < 76 {
        let mut buf = [0u8; 76];
        buf[0] = len as u8;
        buf[1..1 + len].copy_from_slice(data);
        f(&buf[..1 + len])
    } else {
        f(serialize_push_data(data).as_slice())
    }
}

/// Advance `pc` past one opcode (Bitcoin `CScript::GetOp`-compatible sizing).
#[inline]
fn script_get_op_advance(script: &[u8], pc: usize) -> Option<usize> {
    if pc >= script.len() {
        return None;
    }
    let opcode = script[pc];
    let advance = if opcode <= 0x4b {
        1 + opcode as usize
    } else if opcode == OP_PUSHDATA1 && pc + 1 < script.len() {
        2 + script[pc + 1] as usize
    } else if opcode == OP_PUSHDATA2 && pc + 2 < script.len() {
        3 + ((script[pc + 1] as usize) | ((script[pc + 2] as usize) << 8))
    } else if opcode == OP_PUSHDATA4 && pc + 4 < script.len() {
        5 + ((script[pc + 1] as usize)
            | ((script[pc + 2] as usize) << 8)
            | ((script[pc + 3] as usize) << 16)
            | ((script[pc + 4] as usize) << 24))
    } else {
        1
    };
    let next = pc + advance;
    if next > script.len() {
        None
    } else {
        Some(next)
    }
}

/// Legacy CHECKMULTISIG scriptCode. Stays borrowed until a signature push is removed.
fn multisig_script_code<'a, S: AsRef<[u8]>>(
    script: &'a [u8],
    signatures: &[S],
) -> std::borrow::Cow<'a, [u8]> {
    let mut cleaned = std::borrow::Cow::Borrowed(script);
    for sig in signatures {
        let sig = sig.as_ref();
        if sig.is_empty() {
            continue;
        }
        // Push encoding is ≥ sig.len()+1; FindAndDelete is a no-op when pattern can't fit.
        if sig.len().saturating_add(1) > cleaned.len() {
            continue;
        }
        let next = with_push_pattern(sig, |pattern| {
            match find_and_delete(cleaned.as_ref(), pattern) {
                std::borrow::Cow::Owned(next) => Some(next),
                std::borrow::Cow::Borrowed(_) => None,
            }
        });
        if let Some(next) = next {
            cleaned = std::borrow::Cow::Owned(next);
        }
    }
    cleaned
}

/// FindAndDelete — consensus match to the reference FindAndDelete algorithm.
///
/// Do/while loop: flush `[pc2, pc)`, delete consecutive raw occurrences of `pattern` from `pc`,
/// then advance `pc` one opcode via GetOp-style sizing. The inner delete loop can leave `pc`
/// misaligned; the next "opcode" is parsed from that byte (same behavior as the reference impl).
#[cfg_attr(feature = "spec-lock", spec_locked("5.1.1", "FindAndDelete"))]
#[inline]
pub(crate) fn find_and_delete<'a>(script: &'a [u8], pattern: &[u8]) -> std::borrow::Cow<'a, [u8]> {
    if pattern.is_empty() {
        return std::borrow::Cow::Borrowed(script);
    }
    if pattern.len() > script.len() {
        return std::borrow::Cow::Borrowed(script);
    }
    // Fast pre-scan: if pattern doesn't appear anywhere in the raw bytes, it can't appear
    // at any opcode boundary either — skip the full walk and the Vec allocation entirely.
    // `windows()` is O(N) and avoids ~100B-4KB Vec allocation + full script copy on the
    // overwhelmingly common case (CHECKSIG before codeseparator = never matches).
    if !script.windows(pattern.len()).any(|w| w == pattern) {
        return std::borrow::Cow::Borrowed(script);
    }
    let end = script.len();
    let mut n_found = 0usize;
    let mut result = Vec::new();
    let mut pc = 0usize;
    let mut pc2 = 0usize;

    loop {
        result.extend_from_slice(&script[pc2..pc]);
        while end - pc >= pattern.len() && script[pc..pc + pattern.len()] == *pattern {
            pc += pattern.len();
            n_found += 1;
        }
        pc2 = pc;
        if pc >= end {
            break;
        }
        let Some(next_pc) = script_get_op_advance(script, pc) else {
            break;
        };
        pc = next_pc;
    }

    if n_found > 0 {
        result.extend_from_slice(&script[pc2..end]);
        std::borrow::Cow::Owned(result)
    } else {
        std::borrow::Cow::Borrowed(script)
    }
}

/// Return opcode position (0-indexed) of the opcode at byte_index in script. BIP 342 codesep_pos.
fn opcode_position_at_byte(script: &[u8], byte_index: usize) -> u32 {
    let mut pos = 0u32;
    let mut i = 0usize;
    while i < script.len() && i <= byte_index {
        let opcode = script[i];
        let advance = if opcode <= 0x4b {
            1 + opcode as usize
        } else if opcode == OP_PUSHDATA1 && i + 1 < script.len() {
            2 + script[i + 1] as usize
        } else if opcode == OP_PUSHDATA2 && i + 2 < script.len() {
            3 + ((script[i + 1] as usize) | ((script[i + 2] as usize) << 8))
        } else if opcode == OP_PUSHDATA4 && i + 4 < script.len() {
            5 + ((script[i + 1] as usize)
                | ((script[i + 2] as usize) << 8)
                | ((script[i + 3] as usize) << 16)
                | ((script[i + 4] as usize) << 24))
        } else {
            1
        };
        if i == byte_index {
            return pos;
        }
        pos += 1;
        i = std::cmp::min(i + advance, script.len());
    }
    0xffff_ffff
}

/// BIP342 `EvalChecksigTapscript`.
/// `Ok(None)` fails the script. `Ok(Some(success))` is the signature success bit.
fn eval_checksig_tapscript(
    ctx: &context::ScriptContext<'_>,
    flags: u32,
    signature_bytes: &[u8],
    pubkey_bytes: &[u8],
) -> Result<Option<bool>> {
    const VALIDATION_WEIGHT_PER_SIGOP: i64 = 50;
    let success = !signature_bytes.is_empty();
    if success {
        if let Some(weight) = ctx.tapscript_validation_weight {
            let left = weight.get() - VALIDATION_WEIGHT_PER_SIGOP;
            weight.set(left);
            if left < 0 {
                return Ok(None);
            }
        }
    }
    if pubkey_bytes.is_empty() {
        return Ok(None);
    }
    if pubkey_bytes.len() == 32 {
        if !success {
            return Ok(Some(false));
        }
        let Some((sig_bytes, sighash_byte)) = parse_taproot_keypath_sig(signature_bytes) else {
            return Ok(None);
        };
        let (tapscript, codesep_pos) = ctx
            .tapscript_for_sighash
            .map(|s| (s, ctx.tapscript_codesep_pos.unwrap_or(0xffff_ffff)))
            .unwrap_or((&[] as &[u8], 0xffff_ffff));
        let sighash = if tapscript.is_empty() {
            crate::taproot::compute_taproot_signature_hash(
                ctx.tx,
                ctx.input_index,
                ctx.prevout_values,
                ctx.prevout_script_pubkeys,
                sighash_byte,
                None,
            )?
        } else {
            crate::taproot::compute_tapscript_signature_hash(
                ctx.tx,
                ctx.input_index,
                ctx.prevout_values,
                ctx.prevout_script_pubkeys,
                tapscript,
                crate::taproot::TAPROOT_LEAF_VERSION_TAPSCRIPT,
                codesep_pos,
                sighash_byte,
                ctx.taproot_annex_hash,
            )?
        };
        #[cfg(feature = "production")]
        let is_valid = {
            use crate::bip348::verify_tapscript_schnorr_signature;
            verify_tapscript_schnorr_signature(
                &sighash,
                pubkey_bytes,
                &sig_bytes,
                ctx.schnorr_collector,
            )
            .unwrap_or(false)
        };
        #[cfg(not(feature = "production"))]
        let is_valid = {
            let mut pk = [0u8; 32];
            pk.copy_from_slice(pubkey_bytes);
            crate::secp256k1_backend::verify_schnorr(&sig_bytes, &sighash, &pk).unwrap_or(false)
        };
        if !is_valid {
            return Ok(None);
        }
        return Ok(Some(true));
    }
    if flags & crate::script::flags::SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_PUBKEYTYPE != 0 {
        return Ok(None);
    }
    Ok(Some(success))
}

/// ECDSA CHECKSIG shared by `OP_CHECKSIG` and `OP_CHECKSIGVERIFY`.
///
/// Returns whether the signature is valid. The caller applies the empty-signature
/// policy, NULLFAIL, and the stack result. `redeem_script_for_sighash` is the
/// effective script code for this opcode, which can differ from `ctx`.
#[cfg_attr(feature = "production", inline(always))]
fn eval_checksig_ecdsa(
    ctx: &context::ScriptContext<'_>,
    flags: u32,
    signature_bytes: &[u8],
    pubkey_bytes: &[u8],
    redeem_script_for_sighash: Option<&[u8]>,
) -> Result<bool> {
    let tx = ctx.tx;
    let input_index = ctx.input_index;
    let prevout_values = ctx.prevout_values;
    let prevout_script_pubkeys = ctx.prevout_script_pubkeys;
    let block_height = ctx.block_height;
    let network = ctx.network;
    let sigversion = ctx.sigversion;
    let precomputed_bip143 = ctx.precomputed_bip143;
    #[cfg(feature = "production")]
    let sighash_cache = ctx.sighash_cache;

    let sig_len = signature_bytes.len();
    let sighash_byte = signature_bytes[sig_len - 1];
    let _der_sig = &signature_bytes[..sig_len - 1];

    let sighash = if sigversion == SigVersion::WitnessV0 {
        let amount = prevout_values.get(input_index).copied().unwrap_or(0);
        let script_code = redeem_script_for_sighash.unwrap_or_else(|| {
            prevout_script_pubkeys
                .get(input_index)
                .copied()
                .unwrap_or(&[])
        });
        crate::transaction_hash::calculate_bip143_sighash(
            tx,
            input_index,
            script_code,
            amount,
            sighash_byte,
            precomputed_bip143,
        )?
    } else {
        use crate::transaction_hash::{SighashType, calculate_transaction_sighash_single_input};
        let sighash_type = SighashType::from_byte(sighash_byte);
        let sig = signature_bytes;
        let base_script = match (
            redeem_script_for_sighash,
            prevout_script_pubkeys.get(input_index),
        ) {
            (Some(redeem), Some(prevout)) if redeem == *prevout => *prevout,
            (Some(redeem), _) => redeem,
            (None, Some(prevout)) => *prevout,
            (None, None) => &[],
        };
        let cleaned = if sig.len().saturating_add(1) > base_script.len() {
            std::borrow::Cow::Borrowed(base_script)
        } else {
            with_push_pattern(sig, |pattern| find_and_delete(base_script, pattern))
        };
        // Standardness only. Block connect does not set this flag. A witness
        // script may still contain the signature; this branch is non-segwit.
        if sigversion == SigVersion::Base
            && flags & crate::script::flags::SCRIPT_VERIFY_CONST_SCRIPTCODE != 0
            && matches!(cleaned, std::borrow::Cow::Owned(_))
        {
            return Err(ConsensusError::ScriptErrorWithCode {
                code: ScriptErrorCode::SigFindAndDelete,
                message: "signature is in the non-segwit script code".into(),
            });
        }
        calculate_transaction_sighash_single_input(
            tx,
            input_index,
            cleaned.as_ref(),
            prevout_values[input_index],
            sighash_type,
            #[cfg(feature = "production")]
            sighash_cache,
        )?
    };

    let height = block_height.unwrap_or(0);
    #[cfg(feature = "production")]
    let is_valid = signature::with_secp_context(|secp| {
        signature::verify_signature(
            secp,
            pubkey_bytes,
            signature_bytes,
            &sighash,
            flags,
            height,
            network,
            sigversion,
        )
    })?;
    #[cfg(not(feature = "production"))]
    let is_valid = {
        let secp = signature::new_secp();
        signature::verify_signature(
            &secp,
            pubkey_bytes,
            signature_bytes,
            &sighash,
            flags,
            height,
            network,
            sigversion,
        )?
    };
    Ok(is_valid)
}

/// Execute a single opcode with full context including block height, median time-past, and network
#[cfg_attr(feature = "production", inline(always))]
fn execute_opcode_with_context_full(
    opcode: u8,
    stack: &mut Vec<StackElement>,
    flags: u32,
    ctx: &context::ScriptContext<'_>,
    effective_script_code: Option<&[u8]>,
) -> Result<bool> {
    let tx = ctx.tx;
    let input_index = ctx.input_index;
    let prevout_values = ctx.prevout_values;
    let prevout_script_pubkeys = ctx.prevout_script_pubkeys;
    let block_height = ctx.block_height;
    let median_time_past = ctx.median_time_past;
    let network = ctx.network;
    let sigversion = ctx.sigversion;
    let script_sig_for_sighash = ctx.script_sig_for_sighash;
    let tapscript_for_sighash = ctx.tapscript_for_sighash;
    let tapscript_codesep_pos = ctx.tapscript_codesep_pos;
    let redeem_script_for_sighash = effective_script_code;
    #[cfg(feature = "production")]
    let schnorr_collector = ctx.schnorr_collector;
    let precomputed_bip143 = ctx.precomputed_bip143;
    #[cfg(feature = "production")]
    let sighash_cache = ctx.sighash_cache;

    // match ordered by frequency (hot opcodes first for better branch prediction)
    match opcode {
        // OP_CHECKSIG - verify ECDSA signature
        OP_CHECKSIG => {
            if stack.len() >= 2 {
                let pubkey_bytes = stack.pop().unwrap();
                let signature_bytes = stack.pop().unwrap();

                if sigversion == SigVersion::Tapscript {
                    return match eval_checksig_tapscript(
                        ctx,
                        flags,
                        &signature_bytes,
                        &pubkey_bytes,
                    )? {
                        None => Ok(false),
                        Some(ok) => {
                            stack.push(to_stack_element(script_bool_bytes(ok)));
                            Ok(true)
                        }
                    };
                }

                // Empty signature always fails but is valid script execution.
                // The public key is still checked: a hybrid key, and an uncompressed
                // witness v0 key, fail the script before the false result can be dropped.
                if signature_bytes.is_empty() {
                    let compressed_or_uncompressed = matches!(
                        (pubkey_bytes.first(), pubkey_bytes.len()),
                        (Some(0x04), 65) | (Some(0x02 | 0x03), 33)
                    );
                    if flags & flags::SCRIPT_VERIFY_STRICTENC != 0 && !compressed_or_uncompressed {
                        return Err(ConsensusError::ScriptErrorWithCode {
                            code: ScriptErrorCode::PubkeyType,
                            message: "public key must be compressed or uncompressed".into(),
                        });
                    }
                    if sigversion == SigVersion::WitnessV0
                        && flags & flags::SCRIPT_VERIFY_WITNESS_PUBKEYTYPE != 0
                        && !(pubkey_bytes.len() == 33
                            && (pubkey_bytes[0] == 0x02 || pubkey_bytes[0] == 0x03))
                    {
                        return Err(ConsensusError::ScriptErrorWithCode {
                            code: ScriptErrorCode::WitnessPubkeyType,
                            message: "witness v0 pubkey must be compressed".into(),
                        });
                    }
                    stack.push(to_stack_element(&[]));
                    return Ok(true);
                }

                let is_valid = eval_checksig_ecdsa(
                    ctx,
                    flags,
                    &signature_bytes,
                    &pubkey_bytes,
                    redeem_script_for_sighash,
                )?;

                if !is_valid && flags & flags::SCRIPT_VERIFY_NULLFAIL != 0 {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::SigNullFail,
                        message: "OP_CHECKSIG: non-null signature must not fail under NULLFAIL"
                            .into(),
                    });
                }
                stack.push(to_stack_element(script_bool_bytes(is_valid)));
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_CHECKSIGVERIFY - verify signature (Schnorr in Tapscript, ECDSA otherwise)
        OP_CHECKSIGVERIFY => {
            if stack.len() >= 2 {
                let pubkey_bytes = stack.pop().unwrap();
                let signature_bytes = stack.pop().unwrap();

                if sigversion == SigVersion::Tapscript {
                    return match eval_checksig_tapscript(
                        ctx,
                        flags,
                        &signature_bytes,
                        &pubkey_bytes,
                    )? {
                        Some(true) => Ok(true),
                        _ => Ok(false),
                    };
                }

                // Empty signature always fails
                if signature_bytes.is_empty() {
                    return Ok(false);
                }

                let is_valid = eval_checksig_ecdsa(
                    ctx,
                    flags,
                    &signature_bytes,
                    &pubkey_bytes,
                    redeem_script_for_sighash,
                )?;
                Ok(is_valid)
            } else {
                Ok(false)
            }
        }

        // OP_CHECKSIGADD (BIP 342) - Tapscript only. Pops pubkey, n, sig. Verifies Schnorr; if valid push n+1 else fail.
        OP_CHECKSIGADD => {
            if sigversion != SigVersion::Tapscript {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::DisabledOpcode,
                    message: "OP_CHECKSIGADD is only available in Tapscript".into(),
                });
            }
            if stack.len() < 3 {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::InvalidStackOperation,
                    message: "OP_CHECKSIGADD: insufficient stack items (need 3)".into(),
                });
            }
            // BIP 342: pubkey (top), n (second), sig (third)
            let pubkey_bytes = stack.pop().unwrap();
            let n_bytes = stack.pop().unwrap();
            let signature_bytes = stack.pop().unwrap();
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
                && !script_num_is_minimally_encoded(&n_bytes)
            {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::MinimalData,
                    message: "OP_CHECKSIGADD: non-minimal script number".into(),
                });
            }
            let n = script_num_decode(&n_bytes, 4)?;

            match eval_checksig_tapscript(ctx, flags, &signature_bytes, &pubkey_bytes)? {
                None => return Ok(false),
                Some(ok) => {
                    let pushed = if ok { n + 1 } else { n };
                    stack.push(to_stack_element(&script_num_encode(pushed)));
                    return Ok(true);
                }
            }
        }

        // OP_CHECKMULTISIG - verify m-of-n multisig (hot path)
        OP_CHECKMULTISIG => {
            if sigversion == SigVersion::Tapscript {
                return Ok(false);
            }
            // OP_CHECKMULTISIG implementation
            // Stack layout: [dummy] [sig1] ... [sigm] [m] [pubkey1] ... [pubkeyn] [n]
            if stack.len() < 2 {
                return Ok(false);
            }

            // Pop n (number of public keys) — must be decoded as CScriptNum (BIP62)
            let n_bytes = stack.pop().unwrap();
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
                && !script_num_is_minimally_encoded(&n_bytes)
            {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::MinimalData,
                    message: "OP_CHECKMULTISIG: non-minimal key count".into(),
                });
            }
            let n_raw = script_num_decode(&n_bytes, 4).map_err(|_| {
                ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::InvalidStackOperation,
                    message: "OP_CHECKMULTISIG: invalid n encoding".into(),
                }
            })?;
            if !(0..=20).contains(&n_raw) {
                return Ok(false);
            }
            let n = n_raw as usize;
            if stack.len() < n + 1 {
                return Ok(false);
            }

            // Pop n public keys
            let mut pubkeys = Vec::with_capacity(n);
            for _ in 0..n {
                pubkeys.push(stack.pop().unwrap());
            }

            // Pop m (number of required signatures) — must be decoded as CScriptNum (BIP62)
            let m_bytes = stack.pop().unwrap();
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
                && !script_num_is_minimally_encoded(&m_bytes)
            {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::MinimalData,
                    message: "OP_CHECKMULTISIG: non-minimal script number".into(),
                });
            }
            let m_raw = script_num_decode(&m_bytes, 4).map_err(|_| {
                ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::InvalidStackOperation,
                    message: "OP_CHECKMULTISIG: invalid m encoding".into(),
                }
            })?;
            if m_raw < 0 || m_raw as usize > n || m_raw > 20 {
                return Ok(false);
            }
            let m = m_raw as usize;
            if stack.len() < m + 1 {
                return Ok(false);
            }

            // Pop m signatures
            let mut signatures = Vec::with_capacity(m);
            for _ in 0..m {
                signatures.push(stack.pop().unwrap());
            }

            // The extra element must be zero-length when NULLDUMMY is set.
            // OP_0 pushes that. A one-byte 0x00 has length 1 and is rejected.
            // The flag is the whole rule.
            let dummy = stack.pop().unwrap();
            if (flags & flags::SCRIPT_VERIFY_NULLDUMMY) != 0 && !dummy.is_empty() {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::SigNullDummy,
                    message: format!(
                        "OP_CHECKMULTISIG: dummy element {dummy:?} violates BIP147 NULLDUMMY (must be zero-length)"
                    )
                    .into(),
                });
            }

            // Verify signatures against public keys
            // CHECKMULTISIG algorithm: iterate pubkeys, try to match sigs in order
            let height = block_height.unwrap_or(0);
            if flags & 0x02 != 0 {
                for pubkey in &pubkeys {
                    crate::script::signature::reject_strictenc_pubkey(flags, pubkey)?;
                }
                for sig_bytes in &signatures {
                    crate::script::signature::reject_strictenc_signature(flags, sig_bytes)?;
                }
            }

            // FindAndDelete: Remove ALL signatures from scriptCode BEFORE any sighash computation
            // Consensus rule for OP_CHECKMULTISIG (legacy only, not SegWit)
            let cleaned_script_for_multisig: std::borrow::Cow<[u8]> =
                if sigversion == SigVersion::Base {
                    let base_script = match (
                        redeem_script_for_sighash,
                        prevout_script_pubkeys.get(input_index),
                    ) {
                        (Some(redeem), Some(prevout)) if redeem == *prevout => *prevout,
                        (Some(redeem), _) => redeem,
                        (None, Some(prevout)) => *prevout,
                        (None, None) => &[],
                    };
                    multisig_script_code(base_script, &signatures)
                } else {
                    // For SegWit, no FindAndDelete needed
                    std::borrow::Cow::Borrowed(redeem_script_for_sighash.unwrap_or_else(|| {
                        prevout_script_pubkeys
                            .get(input_index)
                            .copied()
                            .unwrap_or(&[])
                    }))
                };
            // Standardness only. Block connect does not set this flag. A witness
            // script may still contain the signature; Owned means a non-segwit removal.
            if sigversion == SigVersion::Base
                && flags & crate::script::flags::SCRIPT_VERIFY_CONST_SCRIPTCODE != 0
                && matches!(cleaned_script_for_multisig, std::borrow::Cow::Owned(_))
            {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::SigFindAndDelete,
                    message: "signature is in the non-segwit script code".into(),
                });
            }

            use crate::transaction_hash::{
                SighashType, calculate_transaction_sighash_single_input,
            };

            // Batch path: when n*m >= 4, precompute sighashes once per sig and batch-verify all (pubkey, sig) pairs.
            #[cfg(feature = "production")]
            let use_batch = pubkeys.len() * signatures.len() >= 4;

            #[cfg(feature = "production")]
            let (valid_sigs, _) = if use_batch {
                // Phase 3: Batch sighash for multisig — use batch_compute_legacy_sighashes when Base
                let sighashes: Vec<[u8; 32]> = if sigversion == SigVersion::Base {
                    let non_empty: Vec<_> = signatures.iter().filter(|s| !s.is_empty()).collect();
                    if non_empty.is_empty() {
                        vec![]
                    } else {
                        let specs: Vec<(usize, u8, &[u8])> = non_empty
                            .iter()
                            .map(|s| {
                                (
                                    input_index,
                                    s.as_ref()[s.as_ref().len() - 1],
                                    cleaned_script_for_multisig.as_ref(),
                                )
                            })
                            .collect();
                        crate::transaction_hash::batch_compute_legacy_sighashes(
                            tx,
                            prevout_values,
                            prevout_script_pubkeys,
                            &specs,
                        )?
                    }
                } else {
                    // WitnessV0 (P2WSH): use BIP143 sighash, not legacy.
                    let amount = prevout_values.get(input_index).copied().unwrap_or(0);
                    signatures
                        .iter()
                        .filter(|s| !s.is_empty())
                        .map(|sig_bytes| {
                            let sighash_byte = sig_bytes[sig_bytes.len() - 1];
                            crate::transaction_hash::calculate_bip143_sighash(
                                tx,
                                input_index,
                                &cleaned_script_for_multisig,
                                amount,
                                sighash_byte,
                                precomputed_bip143,
                            )
                        })
                        .collect::<Result<Vec<_>>>()?
                };

                // Build verification tasks: (pubkey_i, sig_j, sighash_j) for all i,j. Order: j then i (sig_index, pubkey_index)
                let mut tasks: Vec<(&[u8], &[u8], [u8; 32])> =
                    Vec::with_capacity(pubkeys.len() * signatures.len());
                let mut sig_idx_to_sighash_idx = Vec::with_capacity(signatures.len());
                let mut sighash_idx = 0usize;
                for (j, sig_bytes) in signatures.iter().enumerate() {
                    if sig_bytes.is_empty() {
                        sig_idx_to_sighash_idx.push(usize::MAX);
                    } else {
                        sig_idx_to_sighash_idx.push(sighash_idx);
                        let sh = sighashes[sighash_idx];
                        sighash_idx += 1;
                        for pubkey_bytes in &pubkeys {
                            tasks.push((pubkey_bytes.as_ref(), sig_bytes.as_ref(), sh));
                        }
                    }
                }

                let results = if tasks.is_empty() {
                    vec![]
                } else {
                    batch_verify_signatures(&tasks, flags, height, network, sigversion)?
                };

                // Matching: for each pubkey in order, if current sig verifies with this pubkey, advance
                let mut sig_index = 0;
                let mut valid_sigs = 0usize;
                for (i, pubkey_bytes) in pubkeys.iter().enumerate() {
                    if sig_index >= signatures.len() {
                        break;
                    }
                    if sigversion == SigVersion::WitnessV0
                        && flags & crate::script::flags::SCRIPT_VERIFY_WITNESS_PUBKEYTYPE != 0
                        && !(pubkey_bytes.len() == 33
                            && (pubkey_bytes[0] == 0x02 || pubkey_bytes[0] == 0x03))
                    {
                        return Err(ConsensusError::ScriptErrorWithCode {
                            code: ScriptErrorCode::WitnessPubkeyType,
                            message: "witness v0 public key must be compressed".into(),
                        });
                    }
                    // Skip empty sigs without advancing (same as original)
                    while sig_index < signatures.len() && signatures[sig_index].is_empty() {
                        sig_index += 1;
                    }
                    if sig_index >= signatures.len() {
                        break;
                    }
                    let sh_idx = sig_idx_to_sighash_idx[sig_index];
                    if sh_idx == usize::MAX {
                        continue;
                    }
                    let task_idx = sh_idx * pubkeys.len() + i;
                    if task_idx < results.len() && results[task_idx] {
                        valid_sigs += 1;
                        sig_index += 1;
                    }
                }

                (valid_sigs, ())
            } else {
                let mut sig_index = 0;
                let mut valid_sigs = 0;
                let amount = prevout_values.get(input_index).copied().unwrap_or(0);

                for pubkey_bytes in &pubkeys {
                    if sig_index >= signatures.len() {
                        break;
                    }

                    let signature_bytes = &signatures[sig_index];

                    if signature_bytes.is_empty() {
                        continue;
                    }
                    // Encoding failure aborts the script. It is not "try the next key".
                    if sigversion == SigVersion::WitnessV0
                        && flags & crate::script::flags::SCRIPT_VERIFY_WITNESS_PUBKEYTYPE != 0
                        && !(pubkey_bytes.len() == 33
                            && (pubkey_bytes[0] == 0x02 || pubkey_bytes[0] == 0x03))
                    {
                        return Err(ConsensusError::ScriptErrorWithCode {
                            code: ScriptErrorCode::WitnessPubkeyType,
                            message: "witness v0 public key must be compressed".into(),
                        });
                    }

                    let sig_len = signature_bytes.len();
                    let sighash_byte = signature_bytes[sig_len - 1];

                    // WitnessV0 (P2WSH): BIP143 sighash; Base (P2SH legacy): legacy sighash.
                    let sighash = if sigversion == SigVersion::WitnessV0 {
                        crate::transaction_hash::calculate_bip143_sighash(
                            tx,
                            input_index,
                            &cleaned_script_for_multisig,
                            amount,
                            sighash_byte,
                            #[cfg(feature = "production")]
                            precomputed_bip143,
                            #[cfg(not(feature = "production"))]
                            None,
                        )?
                    } else {
                        let sighash_type = SighashType::from_byte(sighash_byte);
                        calculate_transaction_sighash_single_input(
                            tx,
                            input_index,
                            &cleaned_script_for_multisig,
                            prevout_values[input_index],
                            sighash_type,
                            #[cfg(feature = "production")]
                            sighash_cache,
                        )?
                    };

                    #[cfg(feature = "production")]
                    let is_valid = signature::with_secp_context(|secp| {
                        signature::verify_signature(
                            secp,
                            pubkey_bytes,
                            signature_bytes,
                            &sighash,
                            flags,
                            height,
                            network,
                            sigversion,
                        )
                    })?;

                    #[cfg(not(feature = "production"))]
                    let is_valid = {
                        let secp = signature::new_secp();
                        signature::verify_signature(
                            &secp,
                            pubkey_bytes,
                            signature_bytes,
                            &sighash,
                            flags,
                            height,
                            network,
                            sigversion,
                        )?
                    };

                    if is_valid {
                        valid_sigs += 1;
                        sig_index += 1;
                    }
                }
                (valid_sigs, ())
            };

            #[cfg(not(feature = "production"))]
            let (valid_sigs, _) = {
                let mut sig_index = 0;
                let mut valid_sigs = 0;
                let amount = prevout_values.get(input_index).copied().unwrap_or(0);

                for pubkey_bytes in &pubkeys {
                    if sig_index >= signatures.len() {
                        break;
                    }
                    let signature_bytes = &signatures[sig_index];
                    if signature_bytes.is_empty() {
                        continue;
                    }
                    let sig_len = signature_bytes.len();
                    let sighash_byte = signature_bytes[sig_len - 1];

                    // WitnessV0 (P2WSH): BIP143 sighash; Base: legacy sighash.
                    let sighash = if sigversion == SigVersion::WitnessV0 {
                        crate::transaction_hash::calculate_bip143_sighash(
                            tx,
                            input_index,
                            &cleaned_script_for_multisig,
                            amount,
                            sighash_byte,
                            None,
                        )?
                    } else {
                        let sighash_type = SighashType::from_byte(sighash_byte);
                        calculate_transaction_sighash_single_input(
                            tx,
                            input_index,
                            &cleaned_script_for_multisig,
                            prevout_values[input_index],
                            sighash_type,
                        )?
                    };
                    let secp = signature::new_secp();
                    let is_valid = signature::verify_signature(
                        &secp,
                        pubkey_bytes,
                        signature_bytes,
                        &sighash,
                        flags,
                        height,
                        network,
                        sigversion,
                    )?;
                    if is_valid {
                        valid_sigs += 1;
                        sig_index += 1;
                    }
                }
                (valid_sigs, ())
            };

            let success = valid_sigs >= m;
            failed_multisig_nullfail(flags, success, signatures.iter().any(|sig| !sig.is_empty()))?;
            stack.push(to_stack_element(script_bool_bytes(success)));
            Ok(true)
        }

        // OP_CHECKMULTISIGVERIFY - CHECKMULTISIG + VERIFY (hot path)
        OP_CHECKMULTISIGVERIFY => {
            // Execute CHECKMULTISIG first
            let ctx_checkmultisig = context::ScriptContext {
                tx,
                input_index,
                prevout_values,
                prevout_script_pubkeys,
                block_height,
                median_time_past,
                network,
                sigversion,
                redeem_script_for_sighash,
                script_sig_for_sighash,
                tapscript_for_sighash,
                tapscript_codesep_pos,
                taproot_annex_hash: None,
                tapscript_validation_weight: ctx.tapscript_validation_weight,
                #[cfg(feature = "production")]
                schnorr_collector: None,
                precomputed_bip143,
                #[cfg(feature = "production")]
                sighash_cache,
            };
            let result = execute_opcode_with_context_full(
                OP_CHECKMULTISIG,
                stack,
                flags,
                &ctx_checkmultisig,
                redeem_script_for_sighash,
            )?;
            if !result {
                return Ok(false);
            }
            // VERIFY: check top of stack is truthy, then pop it
            if let Some(top) = stack.pop() {
                if !cast_to_bool(&top) {
                    return Ok(false);
                }
                Ok(true)
            } else {
                Ok(false)
            }
        }

        // OP_CHECKLOCKTIMEVERIFY (BIP65)
        // Validates that transaction locktime is >= top stack item
        // If SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY flag is not set, treat as NOP2
        // CLTV does NOT pop the stack — it only reads the top element (NOP-type opcode)
        OP_CHECKLOCKTIMEVERIFY => {
            // If CLTV flag is not enabled, behave as NOP (treat as NOP2)
            if (flags & flags::SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY) == 0 {
                return Ok(true);
            }

            use crate::locktime::{check_bip65, decode_locktime_value};

            if stack.is_empty() {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::InvalidStackOperation,
                    message: "OP_CHECKLOCKTIMEVERIFY: empty stack".into(),
                });
            }

            // Script number, at most 5 bytes. The sign bit is on the last byte.
            let locktime_bytes = stack.last().expect("Stack is not empty");
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
                && !script_num_is_minimally_encoded(locktime_bytes.as_ref())
            {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::MinimalData,
                    message: "OP_CHECKLOCKTIMEVERIFY: non-minimal script number".into(),
                });
            }
            let locktime_number = match decode_locktime_value(locktime_bytes.as_ref()) {
                Some(v) => v,
                None => {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::MinimalData,
                        message: "OP_CHECKLOCKTIMEVERIFY: invalid locktime encoding".into(),
                    });
                }
            };
            if locktime_number < 0 {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::NegativeLocktime,
                    message: "OP_CHECKLOCKTIMEVERIFY: negative locktime".into(),
                });
            }
            // A value above u32::MAX cannot be <= the transaction locktime.
            if locktime_number > u32::MAX as i64 {
                return Ok(false);
            }
            let locktime_value = locktime_number as u32;

            let tx_locktime = tx.lock_time as u32;

            // CheckLockTime order (BIP65): locktime check via check_bip65
            if !check_bip65(tx_locktime, locktime_value) {
                return Ok(false);
            }

            // Input sequence must NOT be SEQUENCE_FINAL (0xffffffff)
            let input_seq = if input_index < tx.inputs.len() {
                tx.inputs[input_index].sequence
            } else {
                0xffffffff
            };
            if input_seq == 0xffffffff {
                return Ok(false);
            }

            // CLTV does NOT pop the stack (NOP-type opcode)
            Ok(true)
        }

        // OP_CHECKSEQUENCEVERIFY (BIP112)
        // Validates that transaction input sequence number meets relative locktime requirement.
        // Implements BIP68: Relative Lock-Time Using Consensus-Enforced Sequence Numbers.
        //
        // Behavior must match consensus (BIP65/112):
        // - If SCRIPT_VERIFY_CHECKSEQUENCEVERIFY flag is not set, behaves as a NOP (no-op)
        // - If the *stack* sequence has the disable flag set (0x80000000), behaves as a NOP
        // - Otherwise the transaction version must be at least 2
        // - If the *input* nSequence disable flag is set (and stack is not disabled), fail
        // - Does NOT remove the top stack item on success (non-consuming)
        OP_CHECKSEQUENCEVERIFY => {
            use crate::locktime::{check_bip112, decode_locktime_value, is_sequence_disabled};

            // If CSV flag is not enabled, behave as NOP (treat as NOP3)
            if (flags & flags::SCRIPT_VERIFY_CHECKSEQUENCEVERIFY) == 0 {
                return Ok(true);
            }

            if stack.is_empty() {
                return Ok(false);
            }

            // Decode sequence value from stack using shared locktime logic.
            // Interpret the top stack element as a sequence value (BIP112).
            let sequence_bytes = stack.last().expect("Stack is not empty");
            if (flags & crate::script::flags::SCRIPT_VERIFY_MINIMALDATA) != 0
                && !script_num_is_minimally_encoded(sequence_bytes.as_ref())
            {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::MinimalData,
                    message: "OP_CHECKSEQUENCEVERIFY: non-minimal script number".into(),
                });
            }
            let sequence_number = match decode_locktime_value(sequence_bytes.as_ref()) {
                Some(v) => v,
                None => return Ok(false), // Invalid encoding
            };
            if sequence_number < 0 {
                return Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::NegativeLocktime,
                    message: "OP_CHECKSEQUENCEVERIFY: negative locktime".into(),
                });
            }
            // Disable flag and BIP68 masks use the low 32 bits of a non-negative number.
            let sequence_value = sequence_number as u32;

            // Get input sequence number
            if input_index >= tx.inputs.len() {
                return Ok(false);
            }
            let input_sequence = tx.inputs[input_index].sequence as u32;

            // Stack disable flag is a NOP on every version. A real relative lock
            // requires transaction version 2 or greater.
            if is_sequence_disabled(sequence_value) {
                return Ok(true);
            }
            if !crate::sequence_locks::version_enforces_relative_lock(tx.version) {
                return Ok(false);
            }
            if is_sequence_disabled(input_sequence) {
                return Ok(false);
            }

            // Type bit matches and the input's low 16 bits are at least the operand's.
            if !check_bip112(sequence_value, input_sequence) {
                return Ok(false);
            }

            // Validation passed - behave as NOP (do NOT pop the sequence value)
            Ok(true)
        }

        // OP_CHECKTEMPLATEVERIFY (BIP119) - OP_NOP4
        // Verifies that the transaction matches a template hash.
        // Implements BIP119: CHECKTEMPLATEVERIFY.
        //
        // Behavior must match consensus:
        // - If SCRIPT_VERIFY_DEFAULT_CHECK_TEMPLATE_VERIFY_HASH flag is not set, behaves as NOP4
        // - Requires exactly 32 bytes on stack (template hash)
        // - Fails if template hash doesn't match transaction
        OP_CHECKTEMPLATEVERIFY => {
            #[cfg(not(feature = "ctv"))]
            {
                upgradable_nop(flags)
            }

            #[cfg(feature = "ctv")]
            {
                use crate::constants::{
                    CTV_ACTIVATION_MAINNET, CTV_ACTIVATION_REGTEST, CTV_ACTIVATION_TESTNET,
                };

                // Check activation
                let ctv_activation = match network {
                    crate::types::Network::Mainnet => CTV_ACTIVATION_MAINNET,
                    crate::types::Network::Testnet => CTV_ACTIVATION_TESTNET,
                    crate::types::Network::Regtest | crate::types::Network::Signet => {
                        CTV_ACTIVATION_REGTEST
                    }
                    // Same sentinel as ForkActivationTable: not active on testnet4.
                    crate::types::Network::Testnet4 => u64::MAX,
                };

                let ctv_active = block_height.map(|h| h >= ctv_activation).unwrap_or(false);
                if !ctv_active {
                    return upgradable_nop(flags);
                }

                if flags & flags::SCRIPT_VERIFY_DEFAULT_CHECK_TEMPLATE_VERIFY_HASH == 0 {
                    return upgradable_nop(flags);
                }

                use crate::bip119::calculate_template_hash;

                // CTV requires exactly 32 bytes (template hash) on stack
                if stack.is_empty() {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::InvalidStackOperation,
                        message: "OP_CHECKTEMPLATEVERIFY: insufficient stack items".into(),
                    });
                }

                let template_hash_bytes = stack.pop().unwrap();

                // Template hash must be exactly 32 bytes
                if template_hash_bytes.len() != 32 {
                    return upgradable_nop(flags);
                }

                // Calculate actual template hash for this transaction
                let mut expected_hash = [0u8; 32];
                expected_hash.copy_from_slice(&template_hash_bytes);

                let actual_hash = calculate_template_hash(tx, input_index).map_err(|e| {
                    ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::TxInvalid,
                        message: format!("CTV hash calculation failed: {e}").into(),
                    }
                })?;

                // Constant-time comparison (use hash_eq from crypto module)
                use crate::crypto::hash_compare::hash_eq;
                let matches = hash_eq(&expected_hash, &actual_hash);

                if !matches {
                    return Ok(false); // Script fails if template doesn't match
                }

                // CTV succeeds - script continues (NOP-type opcode, doesn't push anything)
                Ok(true)
            }
        }

        // OP_CHECKSIGFROMSTACK (BIP348) - replaces OP_SUCCESS204
        // Verifies a BIP 340 Schnorr signature against an arbitrary message.
        // Implements BIP348: CHECKSIGFROMSTACK.
        //
        // Behavior must match BIP341 tapscript verification:
        // - Only available in Tapscript (leaf version 0xc0)
        // - Pops 3 items: pubkey (top), message (second), signature (third)
        // - If signature is empty, pushes empty vector and continues
        // - If signature is valid, pushes 0x01 (single byte)
        // - If signature is invalid, script fails
        OP_CHECKSIGFROMSTACK => {
            #[cfg(not(feature = "csfs"))]
            {
                // OP_CHECKSIGFROMSTACK is an immediate success only while scanning a tapscript.
                // Executing it in a legacy script or a version-0 witness script
                // is an undefined opcode and fails the script.
                if sigversion == SigVersion::Tapscript {
                    return Ok(true);
                }
                Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::BadOpcode,
                    message: "OP_CHECKSIGFROMSTACK is undefined outside tapscript".into(),
                })
            }

            #[cfg(feature = "csfs")]
            {
                // BIP-348: Only available in Tapscript (leaf version 0xc0)
                if sigversion != SigVersion::Tapscript {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::BadOpcode,
                        message: "OP_CHECKSIGFROMSTACK only available in Tapscript".into(),
                    });
                }

                let csfs_active = {
                    use crate::activation::IsForkActive;
                    block_height.is_some_and(|height| {
                        crate::activation::ForkActivationTable::from_network(network)
                            .is_fork_active(crate::types::ForkId::Csfs, height)
                    })
                };
                if !csfs_active {
                    if flags & flags::SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS != 0 {
                        return Err(ConsensusError::ScriptErrorWithCode {
                            code: ScriptErrorCode::DiscourageUpgradableNops,
                            message: "OP_CHECKSIGFROMSTACK not yet activated".into(),
                        });
                    }
                    return Ok(true);
                }

                use crate::bip348::verify_signature_from_stack;

                // BIP-348: If fewer than 3 elements, script MUST fail
                if stack.len() < 3 {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::InvalidStackOperation,
                        message: "OP_CHECKSIGFROMSTACK: insufficient stack items (need 3)".into(),
                    });
                }

                // BIP-348: Pop in order: pubkey (top), message (second), signature (third)
                let pubkey_bytes = stack.pop().unwrap(); // Top
                let message_bytes = stack.pop().unwrap(); // Second
                let signature_bytes = stack.pop().unwrap(); // Third

                // BIP-348: If pubkey size is zero, script MUST fail
                if pubkey_bytes.is_empty() {
                    return Err(ConsensusError::ScriptErrorWithCode {
                        code: ScriptErrorCode::PubkeyType,
                        message: "OP_CHECKSIGFROMSTACK: pubkey size is zero".into(),
                    });
                }

                // BIP-348: If signature is empty, push empty vector and continue
                if signature_bytes.is_empty() {
                    stack.push(to_stack_element(&[])); // Empty vector, not 0
                    return Ok(true);
                }

                // BIP-348: Verify signature (only for 32-byte pubkeys)
                // OPTIMIZATION: Use collector for batch verification if available
                #[cfg(feature = "production")]
                let is_valid = {
                    verify_signature_from_stack(
                        &message_bytes,    // Message (NOT hashed by BIP 340 spec)
                        &pubkey_bytes,     // Pubkey (32 bytes for BIP 340)
                        &signature_bytes,  // Signature (64-byte BIP 340 Schnorr)
                        schnorr_collector, // Pass collector for batch verification
                    )
                    .unwrap_or(false)
                };
                #[cfg(not(feature = "production"))]
                let is_valid = verify_signature_from_stack(
                    &message_bytes,   // Message (NOT hashed by BIP 340 spec)
                    &pubkey_bytes,    // Pubkey (32 bytes for BIP 340)
                    &signature_bytes, // Signature (64-byte BIP 340 Schnorr)
                )
                .unwrap_or(false);

                if !is_valid {
                    // BIP-348: Validation failure immediately terminates script execution
                    return Ok(false);
                }

                // BIP-342/348: per-tapscript validation weight enforces signature-related limits during
                // execution. They are not added to `MAX_BLOCK_SIGOPS_COST` (witness v1 returns 0).

                // BIP-348: Push 0x01 (single byte) if valid
                stack.push(to_stack_element(&[0x01])); // Single byte 0x01, not 1
                Ok(true)
            }
        }

        // cold path for all other opcodes (branch prediction hint)
        _ => execute_opcode_cold(opcode, stack, flags),
    }
}

/// Rare opcode dispatch (`#[cold]` so hot path stays compact).
#[cold]
fn execute_opcode_cold(opcode: u8, stack: &mut Vec<StackElement>, flags: u32) -> Result<bool> {
    execute_opcode(opcode, stack, flags, SigVersion::Base)
}

// ============================================================================
// Benchmarking Utilities
// ============================================================================

/// Clear script verification cache
///
/// Useful for benchmarking to ensure consistent results without cache state
/// pollution between runs.
///
/// # Example
///
/// Get and reset fast-path hit counters (production). Used by block validation to log
/// whether P2PK/P2PKH/P2SH/P2WPKH/P2WSH fast-paths are taken vs interpreter fallback.
/// Returns (p2pk, p2pkh, p2sh, p2wpkh, p2wsh, p2tr, unexec_if, bare_multisig, interpreter).
#[cfg(all(feature = "production", feature = "profile"))]
pub(crate) fn get_and_reset_fast_path_counts() -> (u64, u64, u64, u64, u64, u64, u64, u64, u64) {
    (
        FAST_PATH_P2PK.swap(0, Ordering::Relaxed),
        FAST_PATH_P2PKH.swap(0, Ordering::Relaxed),
        FAST_PATH_P2SH.swap(0, Ordering::Relaxed),
        FAST_PATH_P2WPKH.swap(0, Ordering::Relaxed),
        FAST_PATH_P2WSH.swap(0, Ordering::Relaxed),
        FAST_PATH_P2TR.swap(0, Ordering::Relaxed),
        FAST_PATH_UNEXEC_IF.swap(0, Ordering::Relaxed),
        FAST_PATH_BARE_MULTISIG.swap(0, Ordering::Relaxed),
        FAST_PATH_INTERPRETER.swap(0, Ordering::Relaxed),
    )
}

/// Reset and return the UnexecIf fast-path hit count (production tests / 859672 gate).
#[cfg(feature = "production")]
pub fn take_fast_path_unexec_if() -> u64 {
    FAST_PATH_UNEXEC_IF.swap(0, Ordering::Relaxed)
}

/// ```rust
/// use blvm_consensus::script::clear_script_cache;
///
/// // Clear cache before benchmark run
/// clear_script_cache();
/// ```
#[cfg(all(feature = "production", feature = "benchmarking"))]
pub fn clear_script_cache() {
    if let Some(cache) = SCRIPT_CACHE.get() {
        let mut cache = cache.write().unwrap_or_else(|e| e.into_inner());
        cache.clear();
    }
}

/// Clear hash operation cache
///
/// Useful for benchmarking to ensure consistent results without cache state
/// pollution between runs.
///
/// # Example
///
/// ```rust
/// use blvm_consensus::script::clear_hash_cache;
///
/// // Clear cache before benchmark run
/// clear_hash_cache();
/// ```
#[cfg(all(feature = "production", feature = "benchmarking"))]
pub fn clear_hash_cache() {
    crypto_ops::clear_hash_cache();
}

/// Clear all caches
///
/// Convenience function to clear both script and hash caches.
///
/// # Example
///
/// ```rust
/// use blvm_consensus::script::clear_all_caches;
///
/// // Clear all caches before benchmark run
/// clear_all_caches();
/// ```
#[cfg(all(feature = "production", feature = "benchmarking"))]
pub fn clear_all_caches() {
    clear_script_cache();
    clear_hash_cache();
}

/// Clear thread-local stack pool
///
/// Clears the thread-local stack pool to reset allocation state for benchmarking.
/// This ensures consistent memory allocation patterns across benchmark runs.
///
/// # Example
///
/// ```rust
/// use blvm_consensus::script::clear_stack_pool;
///
/// // Clear pool before benchmark run
/// clear_stack_pool();
/// ```
#[cfg(all(feature = "production", feature = "benchmarking"))]
pub fn clear_stack_pool() {
    STACK_POOL.with(|pool| {
        let mut pool = pool.borrow_mut();
        pool.clear();
    });
}

/// Reset all benchmarking state
///
/// Convenience function to reset all caches and thread-local state for
/// reproducible benchmarks. Also clears sighash templates cache.
///
/// # Example
///
/// ```rust
/// use blvm_consensus::script::reset_benchmarking_state;
///
/// // Reset all state before benchmark run
/// reset_benchmarking_state();
/// ```
#[cfg(all(feature = "production", feature = "benchmarking"))]
pub fn reset_benchmarking_state() {
    clear_all_caches();
    clear_stack_pool();
    disable_caching(false); // Re-enable caching by default
    // Also clear sighash templates (currently no-op as templates aren't populated yet)
    #[cfg(feature = "benchmarking")]
    crate::transaction_hash::clear_sighash_templates();
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn tapscript_truncated_push_is_not_op_success() {
        use crate::types::{Network, OutPoint, Transaction, TransactionInput, TransactionOutput};

        let tx = Transaction {
            version: 2,
            inputs: vec![TransactionInput {
                prevout: OutPoint {
                    hash: [0u8; 32],
                    index: 0,
                },
                sequence: 0xffff_ffff,
                script_sig: vec![],
            }]
            .into(),
            outputs: vec![TransactionOutput {
                value: 0,
                script_pubkey: vec![],
            }]
            .into(),
            lock_time: 0,
        };
        let eval = |script: &[u8]| {
            let mut stack = Vec::new();
            eval_script_with_context_full(
                script,
                &mut stack,
                0,
                &tx,
                0,
                &[0],
                &[&[]],
                None,
                None,
                Network::Mainnet,
                SigVersion::Tapscript,
                None,
                None,
                None,
                Some(0),
                #[cfg(feature = "production")]
                None,
                None,
                #[cfg(feature = "production")]
                None,
            )
        };

        // Opcode 80 is an immediate success. A bare one succeeds.
        assert!(eval(&[0x50]).unwrap());
        // OP_PUSHDATA2 with a one-byte header. 0x50 is leftover length, not an opcode.
        assert!(!eval(&[0x4d, 0x50]).unwrap());
        // OP_PUSHDATA4 with a one-byte header. 0x7e is opcode 126, also an immediate success.
        assert!(!eval(&[0x4e, 0x7e]).unwrap());
        // 0x50 inside a real push is data. The following OP_0 leaves two stack items.
        assert!(!eval(&[0x01, 0x50, 0x00]).unwrap());

        // A push whose payload does not fit is not an immediate-success opcode,
        // whatever byte is left over. One supplied byte is short of every
        // direct push except a one-byte push, which is truncated by itself.
        assert!(!eval(&[0x01]).unwrap(), "direct push 1");
        for opcode in 2u8..=0x4b {
            assert!(!eval(&[opcode, 0x50]).unwrap(), "direct push {opcode}");
        }
        for (header, leftover) in [(0x4cu8, 0x50u8), (0x4d, 0x50), (0x4e, 0x50), (0x4e, 0x7e)] {
            assert!(!eval(&[header, leftover]).unwrap(), "header {header:#x}");
        }
    }

    fn eval_tapscript(
        script: &[u8],
        network: crate::types::Network,
        block_height: Option<u64>,
    ) -> Result<bool> {
        use crate::types::{OutPoint, Transaction, TransactionInput, TransactionOutput};
        let tx = Transaction {
            version: 2,
            inputs: vec![TransactionInput {
                prevout: OutPoint {
                    hash: [0u8; 32],
                    index: 0,
                },
                sequence: 0xffff_ffff,
                script_sig: vec![],
            }]
            .into(),
            outputs: vec![TransactionOutput {
                value: 0,
                script_pubkey: vec![],
            }]
            .into(),
            lock_time: 0,
        };
        let mut stack = Vec::new();
        eval_script_with_context_full(
            script,
            &mut stack,
            0,
            &tx,
            0,
            &[0],
            &[&[]],
            block_height,
            None,
            network,
            SigVersion::Tapscript,
            None,
            None,
            None,
            Some(0),
            #[cfg(feature = "production")]
            None,
            None,
            #[cfg(feature = "production")]
            None,
        )
    }

    #[test]
    fn mainnet_checksigfromstack_is_op_success() {
        let result = eval_tapscript(&[OP_CHECKSIGFROMSTACK], Network::Mainnet, Some(800_000));
        assert_eq!(result.unwrap(), true);
    }

    #[cfg(feature = "csfs")]
    #[test]
    fn active_csfs_is_not_an_immediate_success() {
        let mainnet = eval_tapscript(&[OP_CHECKSIGFROMSTACK], Network::Mainnet, Some(0));
        assert_eq!(mainnet.unwrap(), true);
        let regtest = eval_tapscript(&[OP_CHECKSIGFROMSTACK], Network::Regtest, Some(0));
        assert!(
            !matches!(regtest, Ok(true)),
            "regtest CSFS must run the opcode, got {regtest:?}"
        );
    }

    #[cfg(not(feature = "production"))]
    #[test]
    fn nonproduction_tapscript_schnorr_spend_is_accepted() {
        use crate::taproot::{
            TAPROOT_LEAF_VERSION_TAPSCRIPT, compute_script_merkle_root,
            compute_tapscript_signature_hash,
        };
        use crate::types::{OutPoint, Transaction, TransactionInput, TransactionOutput};
        use secp256k1::{Keypair, Message, Secp256k1, SecretKey};

        let secp = Secp256k1::new();
        let secret = SecretKey::from_slice(&[0x42; 32]).expect("secret");
        let keypair = Keypair::from_secret_key(&secp, &secret);
        let leaf_pk = keypair.x_only_public_key().0.serialize();
        let mut tapscript = vec![0x20];
        tapscript.extend_from_slice(&leaf_pk);
        tapscript.push(OP_CHECKSIG);
        let internal = [
            0x79, 0xbe, 0x66, 0x7e, 0xf9, 0xdc, 0xbb, 0xac, 0x55, 0xa0, 0x62, 0x95, 0xce, 0x87,
            0x0b, 0x07, 0x02, 0x9b, 0xfc, 0xdb, 0x2d, 0xce, 0x28, 0xd9, 0x59, 0xf2, 0x81, 0x5b,
            0x16, 0xf8, 0x17, 0x98,
        ];
        let root = compute_script_merkle_root(&tapscript, &[], TAPROOT_LEAF_VERSION_TAPSCRIPT)
            .expect("root");
        let (output_key, parity) =
            crate::secp256k1_backend::taproot_output_key_with_parity(&internal, &root)
                .expect("tweak");
        let mut script_pubkey = vec![0x51, 0x20];
        script_pubkey.extend_from_slice(&output_key);
        let mut control = vec![TAPROOT_LEAF_VERSION_TAPSCRIPT | parity];
        control.extend_from_slice(&internal);
        let prevout_value = 10_000i64;
        let tx = Transaction {
            version: 2,
            inputs: vec![TransactionInput {
                prevout: OutPoint {
                    hash: [0x71; 32],
                    index: 0,
                },
                script_sig: vec![].into(),
                sequence: 0xffff_ffff,
            }]
            .into(),
            outputs: vec![TransactionOutput {
                value: 9_000,
                script_pubkey: vec![0x51].into(),
            }]
            .into(),
            lock_time: 0,
        };
        let sighash = compute_tapscript_signature_hash(
            &tx,
            0,
            &[prevout_value],
            &[script_pubkey.as_slice()],
            &tapscript,
            TAPROOT_LEAF_VERSION_TAPSCRIPT,
            0xffff_ffff,
            0x00,
            None,
        )
        .expect("sighash");
        let msg = Message::from_digest_slice(&sighash).expect("digest");
        let sig = secp.sign_schnorr_no_aux_rand(&msg, &keypair);
        let witness = vec![sig.as_ref().to_vec(), tapscript, control];
        let accepted = verify_script_with_context_full(
            &tx.inputs[0].script_sig,
            &script_pubkey,
            Some(&witness),
            flags::SCRIPT_VERIFY_WITNESS | flags::SCRIPT_VERIFY_TAPROOT,
            &tx,
            0,
            &[prevout_value],
            &[script_pubkey.as_slice()],
            Some(crate::constants::TAPROOT_ACTIVATION_MAINNET),
            None,
            Network::Mainnet,
            SigVersion::Base,
            None,
        );
        assert_eq!(accepted.unwrap(), true);
    }

    #[test]
    fn checkmultisig_pubkeys_count_toward_opcode_limit() {
        let mut within = vec![0x61; 160];
        within.push(0x00);
        within.push(0x00);
        within.extend(std::iter::repeat(0x00).take(20));
        within.extend_from_slice(&[0x01, 20, 0xae]);
        let mut stack = Vec::new();
        assert!(eval_script(&within, &mut stack, 0, SigVersion::Base).unwrap());

        let mut over = vec![0x61; 181];
        over.push(0x00);
        over.push(0x00);
        over.extend(std::iter::repeat(0x00).take(20));
        over.extend_from_slice(&[0x01, 20, 0xae]);
        let mut stack = Vec::new();
        assert!(eval_script(&over, &mut stack, 0, SigVersion::Base).is_err());

        // n outside 0..=20 is not added. 181 NOPs plus the opcode stay within 201.
        let mut ignored = vec![0x61; 181];
        ignored.extend_from_slice(&[0x00, 0x00, 0x01, 21, 0xae]);
        let mut stack = Vec::new();
        assert!(!eval_script(&ignored, &mut stack, 0, SigVersion::Base).unwrap());
    }

    #[test]
    fn false_script_result_is_an_empty_vector() {
        let mut stack = Vec::new();
        assert!(eval_script(&[0x51, 0x52, 0x87], &mut stack, 0, SigVersion::Base).unwrap());
        assert!(stack.last().unwrap().is_empty());

        let mut stack = Vec::new();
        assert!(eval_script(&[0x51, 0x51, 0x87], &mut stack, 0, SigVersion::Base).unwrap());
        assert_eq!(stack[0].as_slice(), &[1]);

        let mut stack = Vec::new();
        assert!(
            eval_script(
                &[0x00, 0x01, 0x02, 0xac, 0x82],
                &mut stack,
                0,
                SigVersion::Base
            )
            .unwrap()
        );
        assert!(stack.last().unwrap().is_empty());

        let mut stack = Vec::new();
        assert!(
            eval_script(
                &[0x00, 0x00, 0x51, 0x00, 0x51, 0xae, 0x82],
                &mut stack,
                0,
                SigVersion::Base
            )
            .unwrap()
        );
        assert!(stack.last().unwrap().is_empty());
    }

    #[test]
    fn non_der_signature_aborts_the_script() {
        use crate::constants::BIP66_ACTIVATION_MAINNET;
        use crate::types::{Network, OutPoint, Transaction, TransactionInput, TransactionOutput};

        let tx = Transaction {
            version: 1,
            inputs: vec![TransactionInput {
                prevout: OutPoint {
                    hash: [0u8; 32],
                    index: 0,
                },
                sequence: 0xffff_ffff,
                script_sig: vec![],
            }]
            .into(),
            outputs: vec![TransactionOutput {
                value: 0,
                script_pubkey: vec![],
            }]
            .into(),
            lock_time: 0,
        };
        let eval = |script: &[u8], flags: u32| {
            let mut stack = Vec::new();
            eval_script_with_context_full(
                script,
                &mut stack,
                flags,
                &tx,
                0,
                &[0],
                &[&[]],
                Some(BIP66_ACTIVATION_MAINNET),
                None,
                Network::Mainnet,
                SigVersion::Base,
                None,
                None,
                None,
                None,
                #[cfg(feature = "production")]
                None,
                None,
                #[cfg(feature = "production")]
                None,
            )
        };

        let bad = [0x03, 0x30, 0x01, 0x01, 0x01, 0x02, 0xac, 0x75, 0x51];
        assert!(eval(&bad, 0x04).is_err());
        let empty = [0x00, 0x01, 0x02, 0xac, 0x75, 0x51];
        assert!(eval(&empty, 0x04).unwrap());
        assert!(eval(&bad, 0).unwrap());
    }

    #[test]
    fn nested_v0_redeem_push_must_be_canonical() {
        let mut redeem = vec![0x00, 0x14];
        redeem.extend_from_slice(&[0xab; 20]);
        let canonical = serialize_push_data(&redeem);
        let mut pushdata1 = vec![0x4c, redeem.len() as u8];
        pushdata1.extend_from_slice(&redeem);
        assert!(redeem_push_is_canonical(&canonical, &redeem));
        assert!(!redeem_push_is_canonical(&pushdata1, &redeem));
        assert_eq!(canonical[0], 22);
    }

    #[test]
    fn keypath_spend_reaches_the_sighash_check() {
        use crate::script::flags::SCRIPT_VERIFY_WITNESS;
        use crate::types::{Network, OutPoint, Transaction, TransactionInput, TransactionOutput};

        let mut script_pubkey = vec![OP_1, PUSH_32_BYTES];
        script_pubkey.extend_from_slice(&[0x11u8; 32]);
        let tx = Transaction {
            version: 2,
            inputs: vec![TransactionInput {
                prevout: OutPoint {
                    hash: [0x22; 32],
                    index: 0,
                },
                script_sig: vec![].into(),
                sequence: 0xffff_ffff,
            }]
            .into(),
            outputs: vec![TransactionOutput {
                value: 1_000,
                script_pubkey: vec![OP_1].into(),
            }]
            .into(),
            lock_time: 0,
        };
        let witness = vec![vec![0x40u8; 64]];
        let result = verify_script_with_context_full(
            &vec![].into(),
            &script_pubkey,
            Some(&witness),
            SCRIPT_VERIFY_WITNESS,
            &tx,
            0,
            &[],
            &[],
            Some(1),
            None,
            Network::Regtest,
            SigVersion::Tapscript,
            #[cfg(feature = "production")]
            None,
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
            None,
        );
        assert!(
            result.is_err(),
            "a key-path witness with no prevouts must reach the sighash check, got {result:?}"
        );
    }

    #[test]
    fn p2sh_wrapped_unknown_witness_program_succeeds() {
        use digest::Digest;

        let redeem = vec![0x52, 0x02, 0x11, 0x22];
        let hash = ripemd::Ripemd160::digest(sha2::Sha256::digest(&redeem));
        let mut script_pubkey = vec![OP_HASH160, 0x14];
        script_pubkey.extend_from_slice(&hash);
        script_pubkey.push(OP_EQUAL);
        let script_sig = serialize_push_data(&redeem);
        let witness = vec![vec![1u8]];
        let (tx, pv, psp) = minimal_tx_and_prevouts(&script_sig, &script_pubkey);
        let psp_refs: Vec<&[u8]> = psp.iter().map(|b| b.as_ref()).collect();
        let verify = |flags: u32, wit: Option<&Vec<Vec<u8>>>| {
            verify_script_with_context_full(
                &script_sig,
                &script_pubkey,
                wit,
                flags,
                &tx,
                0,
                &pv,
                &psp_refs,
                Some(500_000),
                None,
                crate::types::Network::Mainnet,
                SigVersion::Base,
                #[cfg(feature = "production")]
                None,
                None,
                #[cfg(feature = "production")]
                None,
                #[cfg(feature = "production")]
                None,
                #[cfg(feature = "production")]
                None,
                #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
                None,
            )
        };
        assert!(verify(0x801, Some(&witness)).unwrap());
        assert!(!verify(0x801 | 0x1000, Some(&witness)).unwrap());
        let mut pushdata1 = vec![0x4c, redeem.len() as u8];
        pushdata1.extend_from_slice(&redeem);
        let (tx_pd, pv_pd, psp_pd) = minimal_tx_and_prevouts(&pushdata1, &script_pubkey);
        let psp_pd_refs: Vec<&[u8]> = psp_pd.iter().map(|b| b.as_ref()).collect();
        let noncanonical = verify_script_with_context_full(
            &pushdata1,
            &script_pubkey,
            Some(&witness),
            0x801,
            &tx_pd,
            0,
            &pv_pd,
            &psp_pd_refs,
            Some(500_000),
            None,
            crate::types::Network::Mainnet,
            SigVersion::Base,
            #[cfg(feature = "production")]
            None,
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
            None,
        );
        assert!(!noncanonical.unwrap());

        let invalid_v0 = vec![0x00, 0x02, 0x11, 0x22];
        let hash = ripemd::Ripemd160::digest(sha2::Sha256::digest(&invalid_v0));
        let mut script_pubkey = vec![OP_HASH160, 0x14];
        script_pubkey.extend_from_slice(&hash);
        script_pubkey.push(OP_EQUAL);
        let script_sig = serialize_push_data(&invalid_v0);
        let (tx, pv, psp) = minimal_tx_and_prevouts(&script_sig, &script_pubkey);
        let psp_refs: Vec<&[u8]> = psp.iter().map(|b| b.as_ref()).collect();
        let result = verify_script_with_context_full(
            &script_sig,
            &script_pubkey,
            Some(&witness),
            0x801,
            &tx,
            0,
            &pv,
            &psp_refs,
            Some(500_000),
            None,
            crate::types::Network::Mainnet,
            SigVersion::Base,
            #[cfg(feature = "production")]
            None,
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
            None,
        );
        assert!(!result.unwrap());
    }

    /// scriptPubKey is executed before the witness-program shortcut. An
    /// all-zero or negative-zero program leaves a false stack and fails. A
    /// nonzero program of a future version succeeds.
    #[test]
    fn witness_program_false_payload_is_rejected() {
        use crate::constants::TAPROOT_ACTIVATION_MAINNET;
        use digest::Digest;

        let verify = |script_pubkey: &[u8], script_sig: &[u8], height: u64| {
            let script_sig = script_sig.to_vec();
            let (tx, pv, psp) = minimal_tx_and_prevouts(&script_sig, script_pubkey);
            let refs: Vec<&[u8]> = psp.iter().map(|b| b.as_ref()).collect();
            verify_script_with_context_full(
                &script_sig,
                script_pubkey,
                None,
                0x801,
                &tx,
                0,
                &pv,
                &refs,
                Some(height),
                None,
                crate::types::Network::Mainnet,
                SigVersion::Base,
                #[cfg(feature = "production")]
                None,
                None,
                #[cfg(feature = "production")]
                None,
                #[cfg(feature = "production")]
                None,
                #[cfg(feature = "production")]
                None,
                #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
                None,
            )
        };

        let payloads: &[(&[u8], bool)] = &[
            (&[0x00, 0x00], false),
            (&[0x00, 0x80], false),
            (&[0x01, 0x00], true),
        ];
        for version in 0x51u8..=0x60 {
            for &(payload, truthy) in payloads {
                let mut script = vec![version, payload.len() as u8];
                script.extend_from_slice(payload);
                let got = verify(&script, &[], 400_000).unwrap();
                let taproot_v1 = version == 0x51 && payload.len() == 32;
                let expect = truthy && !taproot_v1;
                assert_eq!(got, expect, "native {script:02x?}");
            }
        }

        let zeros = vec![0u8; 32];
        let mut neg = vec![0u8; 32];
        neg[31] = 0x80;
        let mut nonzero = vec![0u8; 32];
        nonzero[0] = 1;
        for (payload, truthy) in [(&zeros[..], false), (&neg[..], false), (&nonzero[..], true)] {
            let mut script = vec![0x51, 0x20];
            script.extend_from_slice(payload);
            assert!(!verify(&script, &[], TAPROOT_ACTIVATION_MAINNET).unwrap());
            let before = verify(&script, &[], 400_000).unwrap();
            assert_eq!(before, truthy, "v1-32 before taproot {payload:02x?}");
        }

        let redeem = vec![0x52, 0x02, 0x00, 0x00];
        let hash = ripemd::Ripemd160::digest(sha2::Sha256::digest(&redeem));
        let mut p2sh = vec![OP_HASH160, 0x14];
        p2sh.extend_from_slice(&hash);
        p2sh.push(OP_EQUAL);
        let push = serialize_push_data(&redeem);
        assert!(!verify(&p2sh, &push, 400_000).unwrap());

        let redeem_ok = vec![0x52, 0x02, 0x01, 0x00];
        let hash_ok = ripemd::Ripemd160::digest(sha2::Sha256::digest(&redeem_ok));
        let mut p2sh_ok = vec![OP_HASH160, 0x14];
        p2sh_ok.extend_from_slice(&hash_ok);
        p2sh_ok.push(OP_EQUAL);
        assert!(verify(&p2sh_ok, &serialize_push_data(&redeem_ok), 400_000).unwrap());
    }

    /// BIP341 taproot is the native `OP_1 PUSH_32_BYTES` program. The same
    /// program inside pay-to-script-hash stays an upgradable witness program
    /// after activation: a truthy program succeeds, and an all-zero program fails.
    #[test]
    fn p2sh_wrapped_v1_32_stays_upgradable_after_taproot() {
        use crate::constants::TAPROOT_ACTIVATION_MAINNET;
        use crate::script::flags::{SCRIPT_VERIFY_P2SH, SCRIPT_VERIFY_WITNESS};
        use digest::Digest;

        let flags = SCRIPT_VERIFY_P2SH | SCRIPT_VERIFY_WITNESS;
        let verify = |script_pubkey: &[u8], script_sig: &[u8]| {
            let script_sig = script_sig.to_vec();
            let (tx, pv, psp) = minimal_tx_and_prevouts(&script_sig, script_pubkey);
            let refs: Vec<&[u8]> = psp.iter().map(|b| b.as_ref()).collect();
            verify_script_with_context_full(
                &script_sig,
                script_pubkey,
                None,
                flags,
                &tx,
                0,
                &pv,
                &refs,
                Some(TAPROOT_ACTIVATION_MAINNET),
                None,
                crate::types::Network::Mainnet,
                SigVersion::Base,
                #[cfg(feature = "production")]
                None,
                None,
                #[cfg(feature = "production")]
                None,
                #[cfg(feature = "production")]
                None,
                #[cfg(feature = "production")]
                None,
                #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
                None,
            )
        };

        let program_len = PUSH_32_BYTES as usize;
        let mut truthy_redeem = vec![OP_1, PUSH_32_BYTES];
        truthy_redeem.extend(std::iter::repeat(1u8).take(program_len));
        let truthy_hash = ripemd::Ripemd160::digest(sha2::Sha256::digest(&truthy_redeem));
        let mut truthy_p2sh = vec![OP_HASH160, PUSH_20_BYTES];
        truthy_p2sh.extend_from_slice(&truthy_hash);
        truthy_p2sh.push(OP_EQUAL);
        assert!(verify(&truthy_p2sh, &serialize_push_data(&truthy_redeem)).unwrap());
        assert!(!verify(&truthy_redeem, &[]).unwrap());

        let mut zero_redeem = vec![OP_1, PUSH_32_BYTES];
        zero_redeem.extend(std::iter::repeat(0u8).take(program_len));
        let zero_hash = ripemd::Ripemd160::digest(sha2::Sha256::digest(&zero_redeem));
        let mut zero_p2sh = vec![OP_HASH160, PUSH_20_BYTES];
        zero_p2sh.extend_from_slice(&zero_hash);
        zero_p2sh.push(OP_EQUAL);
        assert!(!verify(&zero_p2sh, &serialize_push_data(&zero_redeem)).unwrap());
    }

    #[test]
    fn test_eval_script_simple() {
        let script = vec![OP_1]; // OP_1
        let mut stack = Vec::new();

        assert!(eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap());
        assert_eq!(stack.len(), 1);
        assert_eq!(stack[0].as_slice(), &[1]);
    }

    #[test]
    fn test_eval_script_overflow() {
        let script = vec![0x51; MAX_STACK_SIZE + 1]; // Too many pushes
        let mut stack = Vec::new();

        assert!(eval_script(&script, &mut stack, 0, SigVersion::Base).is_err());
    }

    #[test]
    fn test_verify_script_simple() {
        let _script_sig = [0x51]; // OP_1
        let _script_pubkey = [0x51]; // OP_1

        // This should work: OP_1 pushes 1, then OP_1 pushes another 1
        // Final stack has [1, 1], which is not exactly one non-zero value
        // Let's use a script that results in exactly one value on stack
        let script_sig = vec![0x51]; // OP_1
        let script_pubkey = vec![0x76, 0x88]; // OP_DUP, OP_EQUALVERIFY

        // This should fail because OP_EQUALVERIFY removes both values
        assert!(!verify_script(&script_sig, &script_pubkey, None, 0).unwrap());
    }

    // ============================================================================
    // COMPREHENSIVE OPCODE TESTS
    // ============================================================================

    #[test]
    fn test_op_0() {
        let script = vec![OP_0]; // OP_0
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script always succeeds; stack has empty item (falsy but not an error)
        assert_eq!(stack.len(), 1);
        assert!(stack[0].is_empty());
    }

    #[test]
    fn test_op_1_to_op_16() {
        // Test OP_1 through OP_16
        for i in 1..=16 {
            let opcode = 0x50 + i;
            let script = vec![opcode];
            let mut stack = Vec::new();
            let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
            assert!(result);
            assert_eq!(stack.len(), 1);
            assert_eq!(stack[0].as_slice(), &[i]);
        }
    }

    #[test]
    fn test_op_dup() {
        let script = vec![0x51, 0x76]; // OP_1, OP_DUP
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 2 items (EvalScript doesn't check count)
        assert_eq!(stack.len(), 2);
        assert_eq!(stack[0].as_slice(), &[1]);
        assert_eq!(stack[1].as_slice(), &[1]);
    }

    #[test]
    fn test_op_dup_empty_stack() {
        let script = vec![OP_DUP]; // OP_DUP on empty stack
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
    }

    #[test]
    fn test_op_hash160() {
        let script = vec![OP_1, OP_HASH160]; // OP_1, OP_HASH160
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result);
        assert_eq!(stack.len(), 1);
        assert_eq!(stack[0].len(), 20); // RIPEMD160 output is 20 bytes
    }

    #[test]
    fn test_op_hash160_empty_stack() {
        let script = vec![OP_HASH160]; // OP_HASH160 on empty stack
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
    }

    #[test]
    fn test_op_hash256() {
        let script = vec![OP_1, OP_HASH256]; // OP_1, OP_HASH256
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result);
        assert_eq!(stack.len(), 1);
        assert_eq!(stack[0].len(), 32); // SHA256 output is 32 bytes
    }

    #[test]
    fn test_op_hash256_empty_stack() {
        let script = vec![OP_HASH256]; // OP_HASH256 on empty stack
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
    }

    #[test]
    fn test_op_equal() {
        let script = vec![0x51, 0x51, 0x87]; // OP_1, OP_1, OP_EQUAL
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result);
        assert_eq!(stack.len(), 1);
        assert_eq!(stack[0].as_slice(), &[1]); // True
    }

    #[test]
    fn test_op_equal_false() {
        let script = vec![0x51, 0x52, 0x87]; // OP_1, OP_2, OP_EQUAL
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; OP_EQUAL pushes [] (empty = falsy)
        assert_eq!(stack.len(), 1);
        assert!(stack[0].is_empty()); // False is [] (empty), not [0x00]
    }

    #[test]
    fn test_op_equal_insufficient_stack() {
        let script = vec![0x51, 0x87]; // OP_1, OP_EQUAL (need 2 items)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base);
        assert!(
            result.is_err(),
            "OP_EQUAL with insufficient stack should return error"
        );
        if let Err(crate::error::ConsensusError::ScriptErrorWithCode { code, .. }) = result {
            assert_eq!(
                code,
                crate::error::ScriptErrorCode::InvalidStackOperation,
                "Should return InvalidStackOperation"
            );
        }
    }

    #[test]
    fn test_op_verify() {
        let script = vec![0x51, 0x69]; // OP_1, OP_VERIFY
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; OP_VERIFY consumed the truthy item
        assert_eq!(stack.len(), 0); // OP_VERIFY consumes the top item
    }

    #[test]
    fn test_op_verify_false() {
        let script = vec![0x00, 0x69]; // OP_0, OP_VERIFY (false)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
    }

    #[test]
    fn test_op_verify_empty_stack() {
        let script = vec![OP_VERIFY]; // OP_VERIFY on empty stack
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
    }

    #[test]
    fn test_op_equalverify() {
        let script = vec![0x51, 0x51, 0x88]; // OP_1, OP_1, OP_EQUALVERIFY
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; OP_EQUALVERIFY consumed both equal items
        assert_eq!(stack.len(), 0); // OP_EQUALVERIFY consumes both items
    }

    #[test]
    fn test_op_equalverify_false() {
        let script = vec![0x51, 0x52, 0x88]; // OP_1, OP_2, OP_EQUALVERIFY (false)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base);
        assert!(
            result.is_err(),
            "OP_EQUALVERIFY with false condition should return error"
        );
        if let Err(crate::error::ConsensusError::ScriptErrorWithCode { code, .. }) = result {
            assert_eq!(
                code,
                crate::error::ScriptErrorCode::EqualVerify,
                "Should return EqualVerify"
            );
        }
    }

    #[test]
    fn test_op_checksig() {
        // Note: This test uses simplified inputs. Production code performs full signature verification.
        // The test verifies that OP_CHECKSIG executes without panicking, not that signatures are valid.
        let script = vec![OP_1, OP_1, OP_CHECKSIG]; // OP_1, OP_1, OP_CHECKSIG
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; CHECKSIG pushes [] (invalid sig = falsy) but no error
        assert_eq!(stack.len(), 1);
        // Production code validates signatures using secp256k1; test uses simplified inputs
    }

    #[test]
    fn test_op_checksig_insufficient_stack() {
        let script = vec![OP_1, OP_CHECKSIG]; // OP_1, OP_CHECKSIG (need 2 items)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base);
        assert!(
            result.is_err(),
            "OP_CHECKSIG with insufficient stack should return error"
        );
        if let Err(crate::error::ConsensusError::ScriptErrorWithCode { code, .. }) = result {
            assert_eq!(
                code,
                crate::error::ScriptErrorCode::InvalidStackOperation,
                "Should return InvalidStackOperation"
            );
        }
    }

    #[test]
    fn test_unknown_opcode() {
        let script = vec![0xff]; // Unknown opcode (0xff is not a defined opcode constant)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
    }

    #[test]
    fn test_script_size_limit() {
        let script = vec![0x51; MAX_SCRIPT_SIZE + 1]; // Exceed size limit
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base);
        assert!(result.is_err());
    }

    #[test]
    fn test_operation_count_limit() {
        // Use OP_NOP (0x61) - non-push opcodes count toward limit
        let script = vec![0x61; MAX_SCRIPT_OPS + 1]; // Exceed operation limit
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base);
        assert!(result.is_err());
    }

    #[test]
    fn test_stack_underflow_multiple_ops() {
        let script = vec![0x51, 0x87, 0x87]; // OP_1, OP_EQUAL, OP_EQUAL (second OP_EQUAL will underflow)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base);
        assert!(result.is_err(), "Stack underflow should return error");
        if let Err(crate::error::ConsensusError::ScriptErrorWithCode { code, .. }) = result {
            assert_eq!(
                code,
                crate::error::ScriptErrorCode::InvalidStackOperation,
                "Should return InvalidStackOperation"
            );
        }
    }

    #[test]
    fn test_final_stack_empty() {
        // eval_script (EvalScript) does not check the final stack — VerifyScript does.
        let script = vec![0x51, 0x52]; // OP_1, OP_2 (two items on final stack)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; final stack check is VerifyScript's responsibility
        assert_eq!(stack.len(), 2);
    }

    #[test]
    fn test_final_stack_false() {
        // eval_script (EvalScript) does not check top-of-stack truthiness — VerifyScript does.
        let script = vec![OP_0]; // OP_0 (false on final stack)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; verify_script would return false here
    }

    #[test]
    fn test_verify_script_with_witness() {
        // OP_1 sig + OP_1 pubkey + OP_1 witness leaves 3 truthy items; top is truthy → success.
        let script_sig = vec![OP_1]; // OP_1
        let script_pubkey = vec![OP_1]; // OP_1
        let witness = vec![OP_1]; // OP_1
        let flags = 0;

        let result = verify_script(&script_sig, &script_pubkey, Some(&witness), flags).unwrap();
        assert!(result); // VerifyScript: top of stack is truthy regardless of stack size
    }

    #[test]
    fn test_verify_script_failure() {
        // OP_0 pubkey pushes empty (falsy) item on top; verify_script returns false.
        let script_sig = vec![OP_1]; // OP_1 (truthy)
        let script_pubkey = vec![OP_0]; // OP_0 (pushes empty = falsy)
        let witness = None;
        let flags = 0;

        let result = verify_script(&script_sig, &script_pubkey, witness, flags).unwrap();
        assert!(!result); // VerifyScript: top of stack is [] (falsy) → fail
    }

    // ============================================================================
    // COMPREHENSIVE SCRIPT TESTS
    // ============================================================================

    #[test]
    fn test_op_ifdup_true() {
        let script = vec![OP_1, OP_IFDUP]; // OP_1, OP_IFDUP
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 2 items after dup
        assert_eq!(stack.len(), 2);
        assert_eq!(stack[0].as_slice(), &[1]);
        assert_eq!(stack[1].as_slice(), &[1]);
    }

    #[test]
    fn test_op_ifdup_false() {
        let script = vec![OP_0, OP_IFDUP]; // OP_0, OP_IFDUP
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; IFDUP doesn't dup falsy items
        assert_eq!(stack.len(), 1);
        assert_eq!(stack[0].as_slice(), &[] as &[u8]);
    }

    #[test]
    fn test_op_depth() {
        let script = vec![OP_1, OP_1, OP_DEPTH]; // OP_1, OP_1, OP_DEPTH
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 3 items
        assert_eq!(stack.len(), 3);
        assert_eq!(stack[2].as_slice(), &[2]); // Depth should be 2 (before OP_DEPTH)
    }

    #[test]
    fn test_op_drop() {
        let script = vec![OP_1, OP_2, OP_DROP]; // OP_1, OP_2, OP_DROP
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // Final stack has 1 item [1]
        assert_eq!(stack.len(), 1);
        assert_eq!(stack[0].as_slice(), &[1]);
    }

    #[test]
    fn test_op_drop_empty_stack() {
        let script = vec![OP_DROP]; // OP_DROP on empty stack
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 0);
    }

    #[test]
    fn test_op_nip() {
        let script = vec![OP_1, OP_2, OP_NIP]; // OP_1, OP_2, OP_NIP
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // Final stack has 1 item [2]
        assert_eq!(stack.len(), 1);
        assert_eq!(stack[0].as_slice(), &[2]);
    }

    #[test]
    fn test_op_nip_insufficient_stack() {
        let script = vec![OP_1, OP_NIP]; // OP_1, OP_NIP (only 1 item)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 1);
    }

    #[test]
    fn test_op_over() {
        let script = vec![OP_1, OP_2, OP_OVER]; // OP_1, OP_2, OP_OVER
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 3 items
        assert_eq!(stack.len(), 3);
        assert_eq!(stack[0].as_slice(), &[1]);
        assert_eq!(stack[1].as_slice(), &[2]);
        assert_eq!(stack[2].as_slice(), &[1]);
    }

    #[test]
    fn test_op_over_insufficient_stack() {
        let script = vec![OP_1, OP_OVER]; // OP_1, OP_OVER (only 1 item)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 1);
    }

    #[test]
    fn test_op_pick() {
        let script = vec![OP_1, OP_2, OP_3, OP_1, OP_PICK]; // OP_1, OP_2, OP_3, OP_1, OP_PICK
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 4 items
        assert_eq!(stack.len(), 4);
        assert_eq!(stack[3].as_slice(), &[2]); // Should pick index 1 (OP_2)
    }

    #[test]
    fn test_op_pick_empty_n() {
        // OP_1, OP_0, OP_PICK: n=0 picks top item (duplicates it), stack [1,1]
        let script = vec![OP_1, OP_0, OP_PICK];
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 2 items
        assert_eq!(stack.len(), 2);
        assert_eq!(stack[1].as_slice(), &[1]); // Picked the top (OP_1 value)
    }

    #[test]
    fn test_op_pick_invalid_index() {
        let script = vec![OP_1, OP_2, OP_PICK]; // OP_1, OP_2, OP_PICK (n=2, but only 1 item)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 1);
    }

    #[test]
    fn test_op_roll() {
        let script = vec![OP_1, OP_2, OP_3, OP_1, OP_ROLL]; // OP_1, OP_2, OP_3, OP_1, OP_ROLL
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 3 items
        assert_eq!(stack.len(), 3);
        assert_eq!(stack[0].as_slice(), &[1]);
        assert_eq!(stack[1].as_slice(), &[3]);
        assert_eq!(stack[2].as_slice(), &[2]); // Should roll index 1 (OP_2) to top
    }

    #[test]
    fn test_op_roll_zero_n() {
        // OP_0 pushes empty bytes (CScriptNum 0), OP_ROLL(0) is a valid no-op
        let script = vec![OP_1, OP_0, OP_ROLL]; // OP_1, OP_0, OP_ROLL (n=0, no-op)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // Stack has [1], which is truthy
        assert_eq!(stack.len(), 1);
        assert_eq!(stack[0].as_slice(), &[1]);
    }

    #[test]
    fn test_op_roll_invalid_index() {
        let script = vec![OP_1, OP_2, OP_ROLL]; // OP_1, OP_2, OP_ROLL (n=2, but only 1 item)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 1);
    }

    #[test]
    fn test_op_rot() {
        let script = vec![OP_1, OP_2, OP_3, OP_ROT]; // OP_1, OP_2, OP_3, OP_ROT
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 3 items
        assert_eq!(stack.len(), 3);
        assert_eq!(stack[0].as_slice(), &[2]);
        assert_eq!(stack[1].as_slice(), &[3]);
        assert_eq!(stack[2].as_slice(), &[1]);
    }

    #[test]
    fn test_op_rot_insufficient_stack() {
        let script = vec![OP_1, OP_2, OP_ROT]; // OP_1, OP_2, OP_ROT (only 2 items)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 2);
    }

    #[test]
    fn test_op_swap() {
        let script = vec![OP_1, OP_2, OP_SWAP]; // OP_1, OP_2, OP_SWAP
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 2 items
        assert_eq!(stack.len(), 2);
        assert_eq!(stack[0].as_slice(), &[2]);
        assert_eq!(stack[1].as_slice(), &[1]);
    }

    #[test]
    fn test_op_swap_insufficient_stack() {
        let script = vec![OP_1, OP_SWAP]; // OP_1, OP_SWAP (only 1 item)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 1);
    }

    #[test]
    fn test_op_tuck() {
        let script = vec![OP_1, OP_2, OP_TUCK]; // OP_1, OP_2, OP_TUCK
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 3 items
        assert_eq!(stack.len(), 3);
        assert_eq!(stack[0].as_slice(), &[2]);
        assert_eq!(stack[1].as_slice(), &[1]);
        assert_eq!(stack[2].as_slice(), &[2]);
    }

    #[test]
    fn test_op_tuck_insufficient_stack() {
        let script = vec![OP_1, OP_TUCK]; // OP_1, OP_TUCK (only 1 item)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 1);
    }

    #[test]
    fn test_op_2drop() {
        let script = vec![OP_1, OP_2, OP_3, OP_2DROP]; // OP_1, OP_2, OP_3, OP_2DROP
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // Final stack has 1 item [1]
        assert_eq!(stack.len(), 1);
        assert_eq!(stack[0].as_slice(), &[1]);
    }

    #[test]
    fn test_op_2drop_insufficient_stack() {
        let script = vec![OP_1, OP_2DROP]; // OP_1, OP_2DROP (only 1 item)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 1);
    }

    #[test]
    fn test_op_2dup() {
        let script = vec![OP_1, OP_2, OP_2DUP]; // OP_1, OP_2, OP_2DUP
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 4 items
        assert_eq!(stack.len(), 4);
        assert_eq!(stack[0].as_slice(), &[1]);
        assert_eq!(stack[1].as_slice(), &[2]);
        assert_eq!(stack[2].as_slice(), &[1]);
        assert_eq!(stack[3].as_slice(), &[2]);
    }

    #[test]
    fn test_op_2dup_insufficient_stack() {
        let script = vec![OP_1, OP_2DUP]; // OP_1, OP_2DUP (only 1 item)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 1);
    }

    #[test]
    fn test_op_3dup() {
        let script = vec![OP_1, OP_2, OP_3, OP_3DUP]; // OP_1, OP_2, OP_3, OP_3DUP
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 6 items
        assert_eq!(stack.len(), 6);
        assert_eq!(stack[0].as_slice(), &[1]);
        assert_eq!(stack[1].as_slice(), &[2]);
        assert_eq!(stack[2].as_slice(), &[3]);
        assert_eq!(stack[3].as_slice(), &[1]);
        assert_eq!(stack[4].as_slice(), &[2]);
        assert_eq!(stack[5].as_slice(), &[3]);
    }

    #[test]
    fn test_op_3dup_insufficient_stack() {
        let script = vec![OP_1, OP_2, OP_3DUP]; // OP_1, OP_2, OP_3DUP (only 2 items)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 2);
    }

    #[test]
    fn test_op_2over() {
        let script = vec![OP_1, OP_2, OP_3, OP_4, OP_2OVER]; // OP_1, OP_2, OP_3, OP_4, OP_2OVER
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 6 items
        assert_eq!(stack.len(), 6);
        assert_eq!(stack[4].as_slice(), &[1]); // Should copy second pair
        assert_eq!(stack[5].as_slice(), &[2]);
    }

    #[test]
    fn test_op_2over_insufficient_stack() {
        let script = vec![OP_1, OP_2, OP_3, OP_2OVER]; // OP_1, OP_2, OP_3, OP_2OVER (only 3 items)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 3);
    }

    #[test]
    fn test_op_2rot() {
        // Stack before: [1,2,3,4,5,6] (1=bottom, 6=top)
        // 2ROT moves 6th and 5th from top (=1 and 2) to top preserving order.
        // Stack after:  [3,4,5,6,1,2] (2=top, 1=second)
        let script = vec![OP_1, OP_2, OP_3, OP_4, OP_5, OP_6, OP_2ROT]; // 6 items, OP_2ROT
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 6 items
        assert_eq!(stack.len(), 6);
        assert_eq!(stack[4].as_slice(), &[1]); // OP_1 moved to second-from-top
        assert_eq!(stack[5].as_slice(), &[2]); // OP_2 moved to top
    }

    #[test]
    fn test_op_2rot_insufficient_stack() {
        let script = vec![OP_1, OP_2, OP_3, OP_4, OP_2ROT]; // OP_1, OP_2, OP_3, OP_4, OP_2ROT (only 4 items)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 4);
    }

    #[test]
    fn test_op_2swap() {
        let script = vec![OP_1, OP_2, OP_3, OP_4, OP_2SWAP]; // OP_1, OP_2, OP_3, OP_4, OP_2SWAP
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 4 items
        assert_eq!(stack.len(), 4);
        assert_eq!(stack[0].as_slice(), &[3]); // Should swap second pair
        assert_eq!(stack[1].as_slice(), &[4]);
        assert_eq!(stack[2].as_slice(), &[1]);
        assert_eq!(stack[3].as_slice(), &[2]);
    }

    #[test]
    fn test_op_2swap_insufficient_stack() {
        let script = vec![OP_1, OP_2, OP_3, OP_2SWAP]; // OP_1, OP_2, OP_3, OP_2SWAP (only 3 items)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 3);
    }

    #[test]
    fn test_op_size() {
        let script = vec![OP_1, OP_SIZE]; // OP_1, OP_SIZE
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(result); // eval_script succeeds; stack has 2 items (original + size)
        assert_eq!(stack.len(), 2);
        assert_eq!(stack[0].as_slice(), &[1]);
        assert_eq!(stack[1].as_slice(), &[1]); // Size of [1] is 1
    }

    #[test]
    fn test_op_size_empty_stack() {
        let script = vec![OP_SIZE]; // OP_SIZE on empty stack
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 0);
    }

    #[test]
    fn test_op_return() {
        let script = vec![OP_1, OP_RETURN]; // OP_1, OP_RETURN
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result); // OP_RETURN always fails
        assert_eq!(stack.len(), 1);
    }

    #[test]
    fn test_op_checksigverify() {
        let script = vec![OP_1, OP_2, OP_CHECKSIGVERIFY]; // OP_1, OP_2, OP_CHECKSIGVERIFY
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result); // Should fail due to invalid signature
        assert_eq!(stack.len(), 0);
    }

    #[test]
    fn test_op_checksigverify_insufficient_stack() {
        let script = vec![OP_1, OP_CHECKSIGVERIFY]; // OP_1, OP_CHECKSIGVERIFY (only 1 item)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result);
        assert_eq!(stack.len(), 1);
    }

    #[test]
    fn test_unknown_opcode_comprehensive() {
        let script = vec![OP_1, 0xff]; // OP_1, unknown opcode (0xff is not a defined opcode constant)
        let mut stack = Vec::new();
        let result = eval_script(&script, &mut stack, 0, SigVersion::Base).unwrap();
        assert!(!result); // Unknown opcode should fail
        assert_eq!(stack.len(), 1);
    }

    #[test]
    fn test_verify_signature_invalid_pubkey() {
        let secp = signature::new_secp();
        let invalid_pubkey = vec![0x00]; // Invalid pubkey
        let signature = vec![0x30, 0x06, 0x02, 0x01, 0x00, 0x02, 0x01, 0x00]; // Valid DER signature
        let dummy_hash = [0u8; 32];
        let result = signature::verify_signature(
            &secp,
            &invalid_pubkey,
            &signature,
            &dummy_hash,
            0,
            0,
            crate::types::Network::Regtest,
            SigVersion::Base,
        );
        assert!(!result.unwrap_or(false));
    }

    #[test]
    fn test_verify_signature_invalid_signature() {
        let secp = signature::new_secp();
        let pubkey = vec![
            0x02, 0x79, 0xbe, 0x66, 0x7e, 0xf9, 0xdc, 0xbb, 0xac, 0x55, 0xa0, 0x62, 0x95, 0xce,
            0x87, 0x0b, 0x07, 0x02, 0x9b, 0xfc, 0xdb, 0x2d, 0xce, 0x28, 0xd9, 0x59, 0xf2, 0x81,
            0x5b, 0x16, 0xf8, 0x17, 0x98,
        ]; // Valid pubkey
        let invalid_signature = vec![0x00]; // Invalid signature
        let dummy_hash = [0u8; 32];
        let result = signature::verify_signature(
            &secp,
            &pubkey,
            &invalid_signature,
            &dummy_hash,
            0,
            0,
            crate::types::Network::Regtest,
            SigVersion::Base,
        );
        assert!(!result.unwrap_or(false));
    }

    // ============================================================================
    // Fast-path and verify_script_with_context_full tests
    // ============================================================================

    /// Build a minimal transaction and prevout slices for verify_script_with_context_full.
    fn minimal_tx_and_prevouts(
        script_sig: &[u8],
        script_pubkey: &[u8],
    ) -> (
        crate::types::Transaction,
        Vec<i64>,
        Vec<crate::types::ByteString>,
    ) {
        use crate::types::{OutPoint, Transaction, TransactionInput, TransactionOutput};
        let tx = Transaction {
            version: 1,
            inputs: vec![TransactionInput {
                prevout: OutPoint {
                    hash: [0u8; 32],
                    index: 0,
                },
                sequence: 0xffff_ffff,
                script_sig: script_sig.to_vec(),
            }]
            .into(),
            outputs: vec![TransactionOutput {
                value: 0,
                script_pubkey: script_pubkey.to_vec(),
            }]
            .into(),
            lock_time: 0,
        };
        let prevout_values = vec![0i64];
        let prevout_script_pubkeys_vec = vec![script_pubkey.to_vec()];
        let prevout_script_pubkeys: Vec<&ByteString> = prevout_script_pubkeys_vec.iter().collect();
        (tx, prevout_values, prevout_script_pubkeys_vec)
    }

    #[test]
    fn canonical_p2pk_requires_the_push_opcode_to_match_the_key_length() {
        let compressed = [2u8; PUSH_33_BYTES as usize];
        let mut matched = vec![PUSH_33_BYTES];
        matched.extend_from_slice(&compressed);
        matched.push(OP_CHECKSIG);
        assert_eq!(canonical_p2pk_pubkey(&matched), Some(compressed.as_slice()));

        let mut truncated = vec![PUSH_65_BYTES];
        truncated.extend_from_slice(&compressed);
        truncated.push(OP_CHECKSIG);
        assert!(canonical_p2pk_pubkey(&truncated).is_none());

        let uncompressed = [4u8; PUSH_65_BYTES as usize];
        let mut matched_long = vec![PUSH_65_BYTES];
        matched_long.extend_from_slice(&uncompressed);
        matched_long.push(OP_CHECKSIG);
        assert_eq!(
            canonical_p2pk_pubkey(&matched_long),
            Some(uncompressed.as_slice())
        );

        let mut short_push_on_long_script = vec![PUSH_33_BYTES];
        short_push_on_long_script.extend_from_slice(&uncompressed);
        short_push_on_long_script.push(OP_CHECKSIG);
        assert!(canonical_p2pk_pubkey(&short_push_on_long_script).is_none());
    }

    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
    #[test]
    fn p2pk_fast_path_does_not_accept_a_push_that_does_not_fit() {
        use crate::transaction_hash::{SighashType, calculate_transaction_sighash_single_input};
        use secp256k1::{Message, PublicKey, Secp256k1, SecretKey};

        let secp = Secp256k1::new();
        let secret = SecretKey::from_slice(&[52u8; 32]).expect("secret");
        let pubkey = PublicKey::from_secret_key(&secp, &secret).serialize();

        let spend = |script_pubkey: &[u8]| {
            let (mut tx, prevout_values, prevout_scripts) =
                minimal_tx_and_prevouts(&[], script_pubkey);
            let sighash = calculate_transaction_sighash_single_input(
                &tx,
                0,
                script_pubkey,
                prevout_values[0],
                SighashType::ALL,
                None,
            )
            .expect("sighash");
            let msg = Message::from_digest_slice(&sighash).expect("digest");
            let mut der = secp.sign_ecdsa(&msg, &secret).serialize_der().to_vec();
            der.push(SighashType::ALL.0);
            let script_sig = serialize_push_data(&der);
            tx.inputs[0].script_sig = script_sig.clone();
            let refs: Vec<&[u8]> = prevout_scripts.iter().map(|s| s.as_slice()).collect();
            verify_script_with_context_full(
                &script_sig,
                script_pubkey,
                None,
                0,
                &tx,
                0,
                &prevout_values,
                &refs,
                None,
                None,
                crate::types::Network::Mainnet,
                SigVersion::Base,
                None,
                None,
                None,
                None,
                None,
                None,
            )
            .expect("verify")
        };

        let mut mismatched = vec![PUSH_65_BYTES];
        mismatched.extend_from_slice(&pubkey);
        mismatched.push(OP_CHECKSIG);
        assert!(!spend(&mismatched));

        let mut matched = vec![PUSH_33_BYTES];
        matched.extend_from_slice(&pubkey);
        matched.push(OP_CHECKSIG);
        assert!(spend(&matched));
    }

    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
    #[test]
    fn raw_key_multisig_is_not_accepted_by_the_fast_path() {
        use crate::transaction_hash::{SighashType, calculate_transaction_sighash_single_input};
        use secp256k1::{Message, PublicKey, Secp256k1, SecretKey};

        let secp = Secp256k1::new();
        let secret = SecretKey::from_slice(&[52u8; 32]).expect("secret");
        let pubkey = PublicKey::from_secret_key(&secp, &secret).serialize();

        let spend = |script_pubkey: &[u8]| {
            let (mut tx, prevout_values, prevout_scripts) =
                minimal_tx_and_prevouts(&[], script_pubkey);
            let sighash = calculate_transaction_sighash_single_input(
                &tx,
                0,
                script_pubkey,
                prevout_values[0],
                SighashType::ALL,
                None,
            )
            .expect("sighash");
            let msg = Message::from_digest_slice(&sighash).expect("digest");
            let mut der = secp.sign_ecdsa(&msg, &secret).serialize_der().to_vec();
            der.push(SighashType::ALL.0);
            let mut script_sig = vec![OP_0];
            script_sig.extend(serialize_push_data(&der));
            tx.inputs[0].script_sig = script_sig.clone();
            let refs: Vec<&[u8]> = prevout_scripts.iter().map(|s| s.as_slice()).collect();
            verify_script_with_context_full(
                &script_sig,
                script_pubkey,
                None,
                0,
                &tx,
                0,
                &prevout_values,
                &refs,
                None,
                None,
                crate::types::Network::Mainnet,
                SigVersion::Base,
                None,
                None,
                None,
                None,
                None,
                None,
            )
        };

        let mut pushed = vec![OP_1, PUSH_33_BYTES];
        pushed.extend_from_slice(&pubkey);
        pushed.push(OP_1);
        pushed.push(OP_CHECKMULTISIG);
        assert!(matches!(spend(&pushed), Ok(true)));

        let mut raw = vec![OP_1];
        raw.extend_from_slice(&pubkey);
        raw.push(OP_1);
        raw.push(OP_CHECKMULTISIG);
        assert!(!matches!(spend(&raw), Ok(true)));
    }

    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
    #[test]
    fn reserved_opcode_multisig_is_not_accepted_by_the_fast_path() {
        use crate::transaction_hash::{SighashType, calculate_transaction_sighash_single_input};
        use secp256k1::{Message, PublicKey, Secp256k1, SecretKey};

        let secp = Secp256k1::new();
        let secret = SecretKey::from_slice(&[52u8; 32]).expect("secret");
        let pubkey = PublicKey::from_secret_key(&secp, &secret).serialize();

        let mut redeem = vec![OP_1, PUSH_33_BYTES];
        redeem.extend_from_slice(&pubkey);
        redeem.push(OP_1);
        redeem.push(OP_CHECKMULTISIG);

        let redeem_hash = Ripemd160::digest(OptimizedSha256::new().hash(&redeem));
        let mut p2sh = vec![OP_HASH160, PUSH_20_BYTES];
        p2sh.extend_from_slice(&redeem_hash);
        p2sh.push(OP_EQUAL);

        let spend = |script_pubkey: &[u8], script_code: &[u8], prefix: &[u8], flags: u32| {
            let (mut tx, prevout_values, prevout_scripts) =
                minimal_tx_and_prevouts(&[], script_pubkey);
            let sighash = calculate_transaction_sighash_single_input(
                &tx,
                0,
                script_code,
                prevout_values[0],
                SighashType::ALL,
                None,
            )
            .expect("sighash");
            let msg = Message::from_digest_slice(&sighash).expect("digest");
            let mut der = secp.sign_ecdsa(&msg, &secret).serialize_der().to_vec();
            der.push(SighashType::ALL.0);
            let mut script_sig = prefix.to_vec();
            script_sig.extend(serialize_push_data(&der));
            if script_pubkey.len() == 23 {
                script_sig.extend(serialize_push_data(script_code));
            }
            tx.inputs[0].script_sig = script_sig.clone();
            let refs: Vec<&[u8]> = prevout_scripts.iter().map(|s| s.as_slice()).collect();
            verify_script_with_context_full(
                &script_sig,
                script_pubkey,
                None,
                flags,
                &tx,
                0,
                &prevout_values,
                &refs,
                None,
                None,
                crate::types::Network::Mainnet,
                SigVersion::Base,
                None,
                None,
                None,
                None,
                None,
                None,
            )
        };

        assert!(matches!(spend(&redeem, &redeem, &[OP_0], 0), Ok(true)));
        assert!(!matches!(
            spend(&redeem, &redeem, &[OP_RESERVED], 0),
            Ok(true)
        ));
        assert!(matches!(
            spend(&p2sh, &redeem, &[OP_0], flags::SCRIPT_VERIFY_P2SH),
            Ok(true)
        ));
        assert!(!matches!(
            spend(&p2sh, &redeem, &[OP_RESERVED], flags::SCRIPT_VERIFY_P2SH),
            Ok(true)
        ));
    }

    #[test]
    #[allow(deprecated)]
    fn verify_script_runs_the_p2sh_redeem_script() {
        let bad = vec![OP_RESERVED];
        let bad_hash = Ripemd160::digest(OptimizedSha256::new().hash(&bad));
        let mut bad_pubkey = vec![OP_HASH160, PUSH_20_BYTES];
        bad_pubkey.extend_from_slice(&bad_hash);
        bad_pubkey.push(OP_EQUAL);
        assert_eq!(
            verify_script(
                &serialize_push_data(&bad),
                &bad_pubkey,
                None,
                flags::SCRIPT_VERIFY_P2SH
            )
            .unwrap(),
            false
        );

        let ok = vec![OP_1];
        let ok_hash = Ripemd160::digest(OptimizedSha256::new().hash(&ok));
        let mut ok_pubkey = vec![OP_HASH160, PUSH_20_BYTES];
        ok_pubkey.extend_from_slice(&ok_hash);
        ok_pubkey.push(OP_EQUAL);
        assert_eq!(
            verify_script(
                &serialize_push_data(&ok),
                &ok_pubkey,
                None,
                flags::SCRIPT_VERIFY_P2SH
            )
            .unwrap(),
            true
        );
    }

    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
    #[test]
    fn hybrid_pubkey_is_accepted_without_strictenc() {
        use crate::transaction_hash::{SighashType, calculate_transaction_sighash_single_input};
        use secp256k1::{Message, PublicKey, Secp256k1, SecretKey};

        const PUBKEY_UNCOMPRESSED: u8 = 0x04;
        const PUBKEY_HYBRID_EVEN: u8 = 0x06;
        const PUBKEY_HYBRID_ODD: u8 = 0x07;

        let secp = Secp256k1::new();
        let secret = SecretKey::from_slice(&[53u8; 32]).expect("secret");
        let mut uncompressed = PublicKey::from_secret_key(&secp, &secret).serialize_uncompressed();
        assert_eq!(uncompressed[0], PUBKEY_UNCOMPRESSED);
        let y_odd = uncompressed[64] & 1 == 1;
        let matching = if y_odd {
            PUBKEY_HYBRID_ODD
        } else {
            PUBKEY_HYBRID_EVEN
        };
        let mismatched = if y_odd {
            PUBKEY_HYBRID_EVEN
        } else {
            PUBKEY_HYBRID_ODD
        };

        let spend = |pubkey: &[u8], flags: u32| {
            let mut script_pubkey = vec![PUSH_65_BYTES];
            script_pubkey.extend_from_slice(pubkey);
            script_pubkey.push(OP_CHECKSIG);
            let (mut tx, prevout_values, prevout_scripts) =
                minimal_tx_and_prevouts(&[], &script_pubkey);
            let sighash = calculate_transaction_sighash_single_input(
                &tx,
                0,
                &script_pubkey,
                prevout_values[0],
                SighashType::ALL,
                None,
            )
            .expect("sighash");
            let msg = Message::from_digest_slice(&sighash).expect("digest");
            let mut der = secp.sign_ecdsa(&msg, &secret).serialize_der().to_vec();
            der.push(SighashType::ALL.0);
            let script_sig = serialize_push_data(&der);
            tx.inputs[0].script_sig = script_sig.clone();
            let refs: Vec<&[u8]> = prevout_scripts.iter().map(|s| s.as_slice()).collect();
            verify_script_with_context_full(
                &script_sig,
                &script_pubkey,
                None,
                flags,
                &tx,
                0,
                &prevout_values,
                &refs,
                None,
                None,
                crate::types::Network::Mainnet,
                SigVersion::Base,
                None,
                None,
                None,
                None,
                None,
                None,
            )
        };

        let block_flags = flags::SCRIPT_VERIFY_P2SH
            | flags::SCRIPT_VERIFY_WITNESS
            | flags::SCRIPT_VERIFY_TAPROOT
            | flags::SCRIPT_VERIFY_DERSIG;
        uncompressed[0] = matching;
        assert!(matches!(spend(&uncompressed, 0), Ok(true)));
        assert!(matches!(spend(&uncompressed, block_flags), Ok(true)));
        assert!(!matches!(
            spend(&uncompressed, flags::SCRIPT_VERIFY_STRICTENC),
            Ok(true)
        ));
        uncompressed[0] = mismatched;
        assert!(!matches!(spend(&uncompressed, 0), Ok(true)));
        uncompressed[0] = PUBKEY_UNCOMPRESSED;
        assert!(matches!(spend(&uncompressed, 0), Ok(true)));
    }

    #[test]
    fn discouraged_nop_uses_the_upgradable_nop_flag() {
        let discourage = flags::SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS;
        let reserved = [OP_NOP1, OP_NOP5, OP_NOP10, OP_CHECKTEMPLATEVERIFY];

        let eval = |script: &[u8], flags: u32| {
            let mut stack = Vec::new();
            eval_script(script, &mut stack, flags, SigVersion::Base)
        };
        let with_context = |opcode: u8, flags: u32| {
            let script_pubkey = vec![OP_1, opcode];
            let script_sig = Vec::new();
            let (tx, pv, psp) = minimal_tx_and_prevouts(&script_sig, &script_pubkey);
            let refs: Vec<&[u8]> = psp.iter().map(|b| b.as_ref()).collect();
            verify_script_with_context_full(
                &script_sig,
                &script_pubkey,
                None,
                flags,
                &tx,
                0,
                &pv,
                &refs,
                None,
                None,
                crate::types::Network::Mainnet,
                SigVersion::Base,
                #[cfg(feature = "production")]
                None,
                None,
                #[cfg(feature = "production")]
                None,
                #[cfg(feature = "production")]
                None,
                #[cfg(feature = "production")]
                None,
                #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
                None,
            )
        };
        let is_discouraged = |result: Result<bool>| match result {
            Err(ConsensusError::ScriptErrorWithCode { code, .. }) => {
                code == ScriptErrorCode::DiscourageUpgradableNops
            }
            _ => false,
        };

        for opcode in reserved {
            let script = [OP_1, opcode];
            assert!(eval(&script, 0).unwrap());
            assert!(is_discouraged(eval(&script, discourage)));
            assert!(eval(&script, flags::SCRIPT_VERIFY_CONST_SCRIPTCODE).unwrap());
            assert!(eval(&script, flags::SCRIPT_VERIFY_WITNESS_PUBKEYTYPE).unwrap());
            assert!(with_context(opcode, 0).unwrap());
            assert!(is_discouraged(with_context(opcode, discourage)));
            assert!(with_context(opcode, flags::SCRIPT_VERIFY_CONST_SCRIPTCODE).unwrap());
        }

        assert!(eval(&[OP_1, OP_NOP], discourage).unwrap());
        assert!(eval(&[OP_1, OP_CHECKLOCKTIMEVERIFY], discourage).unwrap());
        assert!(eval(&[OP_0, OP_IF, OP_NOP1, OP_ENDIF, OP_1], discourage,).unwrap());
        assert!(with_context(OP_NOP, discourage).unwrap());
        assert!(with_context(OP_CHECKLOCKTIMEVERIFY, discourage).unwrap());
    }

    #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
    #[test]
    fn nullfail_waits_until_the_multisig_fails() {
        use crate::transaction_hash::{SighashType, calculate_transaction_sighash_single_input};
        use secp256k1::{Message, PublicKey, Secp256k1, SecretKey};

        let secp = Secp256k1::new();
        let signing = SecretKey::from_slice(&[53u8; 32]).expect("secret");
        let other = SecretKey::from_slice(&[54u8; 32]).expect("secret");
        let outsider = SecretKey::from_slice(&[55u8; 32]).expect("secret");
        let signing_pk = PublicKey::from_secret_key(&secp, &signing).serialize();
        let other_pk = PublicKey::from_secret_key(&secp, &other).serialize();

        let multisig = |prefix: &[u8], first: &[u8], second: &[u8]| {
            let mut script = prefix.to_vec();
            script.push(OP_1);
            script.push(PUSH_33_BYTES);
            script.extend_from_slice(first);
            script.push(PUSH_33_BYTES);
            script.extend_from_slice(second);
            script.push(OP_2);
            script.push(OP_CHECKMULTISIG);
            script
        };
        let spend = |script_pubkey: &[u8], secret: &SecretKey, flags: u32| {
            let (mut tx, prevout_values, prevout_scripts) =
                minimal_tx_and_prevouts(&[], script_pubkey);
            let sighash = calculate_transaction_sighash_single_input(
                &tx,
                0,
                script_pubkey,
                prevout_values[0],
                SighashType::ALL,
                None,
            )
            .expect("sighash");
            let msg = Message::from_digest_slice(&sighash).expect("digest");
            let mut der = secp.sign_ecdsa(&msg, secret).serialize_der().to_vec();
            der.push(SighashType::ALL.0);
            let mut script_sig = vec![OP_0];
            script_sig.extend(serialize_push_data(&der));
            tx.inputs[0].script_sig = script_sig.clone();
            let refs: Vec<&[u8]> = prevout_scripts.iter().map(|s| s.as_slice()).collect();
            verify_script_with_context_full(
                &script_sig,
                script_pubkey,
                None,
                flags,
                &tx,
                0,
                &prevout_values,
                &refs,
                None,
                None,
                crate::types::Network::Mainnet,
                SigVersion::Base,
                None,
                None,
                None,
                None,
                None,
                None,
            )
        };
        let nullfail_error = |result: Result<bool>| {
            matches!(
                result,
                Err(ConsensusError::ScriptErrorWithCode {
                    code: ScriptErrorCode::SigNullFail,
                    ..
                })
            )
        };

        let nullfail = flags::SCRIPT_VERIFY_NULLFAIL;
        // Leading OP_NOP skips the bare-multisig fast path. The interpreter tries the
        // last key first, so this signature misses once and then matches.
        let interpreter = multisig(&[OP_NOP], &signing_pk, &other_pk);
        assert!(matches!(spend(&interpreter, &signing, nullfail), Ok(true)));
        assert!(matches!(spend(&interpreter, &signing, 0), Ok(true)));
        assert!(nullfail_error(spend(&interpreter, &outsider, nullfail)));
        assert!(matches!(spend(&interpreter, &outsider, 0), Ok(false)));

        // Fast path tries keys in script order. The signature misses the first key.
        let fast_path = multisig(&[], &other_pk, &signing_pk);
        assert!(matches!(spend(&fast_path, &signing, nullfail), Ok(true)));
    }

    #[test]
    fn test_verify_with_context_p2pkh_hash_mismatch() {
        // P2PKH pattern but pubkey hash does not match script_pubkey -> false (fast-path or interpreter).
        let pubkey = vec![0x02u8; 33]; // dummy compressed pubkey
        let sig = vec![0x30u8; 70]; // dummy sig (with sighash byte)
        let mut script_sig = Vec::new();
        script_sig.push(sig.len() as u8);
        script_sig.extend(&sig);
        script_sig.push(pubkey.len() as u8);
        script_sig.extend(&pubkey);

        let mut script_pubkey = vec![OP_DUP, OP_HASH160, PUSH_20_BYTES];
        script_pubkey.extend(&[0u8; 20]); // wrong hash (not HASH160(pubkey))
        script_pubkey.push(OP_EQUALVERIFY);
        script_pubkey.push(OP_CHECKSIG);

        let (tx, pv, psp) = minimal_tx_and_prevouts(&script_sig, &script_pubkey);
        let psp_refs: Vec<&[u8]> = psp.iter().map(|b| b.as_ref()).collect();
        let result = verify_script_with_context_full(
            &script_sig,
            &script_pubkey,
            None,
            0,
            &tx,
            0,
            &pv,
            &psp_refs,
            Some(500_000),
            None,
            crate::types::Network::Mainnet,
            SigVersion::Base,
            #[cfg(feature = "production")]
            None,
            None, // precomputed_bip143
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
            None,
        );
        assert!(result.is_ok());
        assert!(!result.unwrap());
    }

    #[test]
    fn test_verify_with_context_p2sh_hash_mismatch() {
        // P2SH pattern but redeem script hash does not match -> false.
        let redeem = vec![OP_1, OP_1, OP_ADD]; // minimal redeem
        let mut script_sig = Vec::new();
        script_sig.push(redeem.len() as u8);
        script_sig.extend(&redeem);

        let mut script_pubkey = vec![OP_HASH160, PUSH_20_BYTES];
        script_pubkey.extend(&[0u8; 20]); // wrong hash (not HASH160(redeem))
        script_pubkey.push(OP_EQUAL);

        let (tx, pv, psp) = minimal_tx_and_prevouts(&script_sig, &script_pubkey);
        let psp_refs: Vec<&[u8]> = psp.iter().map(|b| b.as_ref()).collect();
        let result = verify_script_with_context_full(
            &script_sig,
            &script_pubkey,
            None,
            0x01, // P2SH
            &tx,
            0,
            &pv,
            &psp_refs,
            Some(500_000),
            None,
            crate::types::Network::Mainnet,
            SigVersion::Base,
            #[cfg(feature = "production")]
            None,
            None, // precomputed_bip143
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
            None,
        );
        assert!(result.is_ok());
        assert!(!result.unwrap());
    }

    #[test]
    fn test_verify_with_context_p2wpkh_wrong_witness_size() {
        // P2WPKH script_pubkey but witness has 1 element (need 2) -> false.
        let mut script_pubkey = vec![OP_0, PUSH_20_BYTES];
        script_pubkey.extend(&[0u8; 20]);
        let witness: Vec<Vec<u8>> = vec![vec![0x30; 70]]; // only sig, no pubkey
        let (tx, pv, psp) = minimal_tx_and_prevouts(&[], &script_pubkey);
        let psp_refs: Vec<&[u8]> = psp.iter().map(|b| b.as_ref()).collect();
        let empty: Vec<u8> = vec![];
        let result = verify_script_with_context_full(
            &empty,
            &script_pubkey,
            Some(&witness),
            0,
            &tx,
            0,
            &pv,
            &psp_refs,
            Some(500_000),
            None,
            crate::types::Network::Mainnet,
            SigVersion::Base,
            #[cfg(feature = "production")]
            None,
            None, // precomputed_bip143
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
            None,
        );
        assert!(result.is_ok());
        assert!(!result.unwrap());
    }

    #[test]
    fn test_verify_with_context_p2wsh_wrong_witness_script_hash() {
        // P2WSH script_pubkey but SHA256(witness_script) != program -> false.
        let witness_script = vec![OP_1];
        let mut script_pubkey = vec![OP_0, PUSH_32_BYTES];
        script_pubkey.extend(&[0u8; 32]); // wrong hash (not SHA256(witness_script))
        let witness: Vec<Vec<u8>> = vec![witness_script];
        let (tx, pv, psp) = minimal_tx_and_prevouts(&[], &script_pubkey);
        let psp_refs: Vec<&[u8]> = psp.iter().map(|b| b.as_ref()).collect();
        let empty: Vec<u8> = vec![];
        let result = verify_script_with_context_full(
            &empty,
            &script_pubkey,
            Some(&witness),
            0,
            &tx,
            0,
            &pv,
            &psp_refs,
            Some(500_000),
            None,
            crate::types::Network::Mainnet,
            SigVersion::Base,
            #[cfg(feature = "production")]
            None,
            None, // precomputed_bip143
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
            None,
        );
        assert!(result.is_ok());
        assert!(!result.unwrap());
    }

    #[test]
    #[cfg(feature = "production")]
    fn test_p2wsh_multisig_fast_path() {
        // P2WSH 2-of-2 multisig: fast path parses and validates; placeholder sigs fail -> Ok(false).
        use crate::constants::BIP147_ACTIVATION_MAINNET;
        use crate::crypto::OptimizedSha256;

        let pk1 = [0x02u8; PUSH_33_BYTES as usize];
        let pk2 = [0x03u8; PUSH_33_BYTES as usize];
        let mut witness_script = vec![OP_2, PUSH_33_BYTES];
        witness_script.extend_from_slice(&pk1);
        witness_script.push(PUSH_33_BYTES);
        witness_script.extend_from_slice(&pk2);
        witness_script.push(OP_2);
        witness_script.push(OP_CHECKMULTISIG);

        let wsh_hash = OptimizedSha256::new().hash(&witness_script);
        let mut script_pubkey = vec![OP_0, PUSH_32_BYTES];
        script_pubkey.extend_from_slice(&wsh_hash);

        let witness: Vec<Vec<u8>> = vec![
            vec![],           // zero-length NULLDUMMY
            vec![0x30u8; 72], // placeholder sig 1
            vec![0x30u8; 72], // placeholder sig 2
            witness_script.clone(),
        ];

        let (tx, pv, psp) = minimal_tx_and_prevouts(&[], &script_pubkey);
        let psp_refs: Vec<&[u8]> = psp.iter().map(|b| b.as_ref()).collect();
        let empty: Vec<u8> = vec![];
        let result = verify_script_with_context_full(
            &empty,
            &script_pubkey,
            Some(&witness),
            0x810, // SIGHASH_ALL | VERIFY_NULLDUMMY | VERIFY_NULLFAIL
            &tx,
            0,
            &pv,
            &psp_refs,
            Some(BIP147_ACTIVATION_MAINNET + 1),
            None,
            crate::types::Network::Mainnet,
            SigVersion::Base,
            #[cfg(feature = "production")]
            None,
            None, // precomputed_bip143
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(feature = "production")]
            None,
            #[cfg(all(feature = "production", feature = "blvm-secp256k1"))]
            None,
        );
        assert!(result.is_ok());
        assert!(!result.unwrap());
    }
}

#[cfg(test)]
#[allow(unused_doc_comments)]
mod property_tests {
    use super::*;
    use proptest::prelude::*;

    /// Property test: eval_script respects operation limits
    ///
    /// Mathematical specification:
    /// ∀ script ∈ ByteString: |script| > MAX_SCRIPT_OPS ⟹ eval_script fails
    proptest! {
        #[test]
        fn prop_eval_script_operation_limit(extra in 0usize..=8usize) {
            let mut stack = Vec::new();
            let over = vec![OP_NOP; MAX_SCRIPT_OPS as usize + 1 + extra];
            let rejected = eval_script(&over, &mut stack, 0, SigVersion::Base);
            prop_assert!(
                rejected.is_err(),
                "more than {MAX_SCRIPT_OPS} non-push opcodes is rejected"
            );

            let mut stack = Vec::new();
            let under = vec![OP_NOP; MAX_SCRIPT_OPS as usize];
            prop_assert!(eval_script(&under, &mut stack, 0, SigVersion::Base).is_ok());
        }
    }

    /// Property test: verify_script is deterministic
    ///
    /// Mathematical specification:
    /// ∀ inputs: verify_script(inputs) = verify_script(inputs)
    proptest! {
        #[test]
        fn prop_verify_script_deterministic(
            script_sig in prop::collection::vec(any::<u8>(), 0..20),
            script_pubkey in prop::collection::vec(any::<u8>(), 0..20),
            witness in prop::option::of(prop::collection::vec(any::<u8>(), 0..10)),
            flags in any::<u32>()
        ) {
            let result1 = verify_script(&script_sig, &script_pubkey, witness.as_ref(), flags);
            let result2 = verify_script(&script_sig, &script_pubkey, witness.as_ref(), flags);

            assert_eq!(result1.is_ok(), result2.is_ok());
            if result1.is_ok() && result2.is_ok() {
                assert_eq!(result1.unwrap(), result2.unwrap());
            }
        }
    }

    /// Property test: execute_opcode handles all opcodes without panicking
    ///
    /// Mathematical specification:
    /// ∀ opcode ∈ {0..255}, stack ∈ Vec<StackElement>: execute_opcode(opcode, stack) ∈ {true, false}
    proptest! {
        #[test]
        fn prop_execute_opcode_no_panic(
            opcode in any::<u8>(),
            stack_items in prop::collection::vec(
                prop::collection::vec(any::<u8>(), 0..5),
                0..10
            ),
            flags in any::<u32>()
        ) {
            let mut stack: Vec<StackElement> = stack_items.into_iter().map(|v| to_stack_element(&v)).collect();
            let result = execute_opcode(opcode, &mut stack, flags, SigVersion::Base);

            // Some opcodes may return errors (invalid opcodes, insufficient stack, etc.)
            // The important thing is that it doesn't panic
            match result {
                Ok(success) => {
                    // Just test it returns a boolean (success is either true or false)
                    let _ = success;
                },
                Err(_) => {
                    // Errors are acceptable - invalid opcodes, insufficient stack, etc.
                    // The test is about not panicking, not about always succeeding
                }
            }

            // Stack should remain within bounds
            assert!(stack.len() <= MAX_STACK_SIZE);
        }
    }

    /// Property test: stack operations preserve bounds
    ///
    /// Mathematical specification:
    /// ∀ opcode ∈ {0..255}, stack ∈ Vec<StackElement>:
    /// - |stack| ≤ MAX_STACK_SIZE before and after execute_opcode
    /// - Stack operations are well-defined
    proptest! {
        #[test]
        fn prop_stack_operations_bounds(
            opcode in any::<u8>(),
            stack_items in prop::collection::vec(
                prop::collection::vec(any::<u8>(), 0..3),
                0..5
            ),
            flags in any::<u32>()
        ) {
            let mut stack: Vec<StackElement> = stack_items.into_iter().map(|v| to_stack_element(&v)).collect();
            let initial_len = stack.len();

            let result = execute_opcode(opcode, &mut stack, flags, SigVersion::Base);

            // Stack should never exceed MAX_STACK_SIZE
            assert!(stack.len() <= MAX_STACK_SIZE);

            // If operation succeeded, stack should be in valid state
            if result.is_ok() && result.unwrap() {
                // For opcodes that modify stack size, verify reasonable bounds
                match opcode {
                    OP_0 | OP_1..=OP_16 => {
                        // Push opcodes - increase by 1
                        assert!(stack.len() == initial_len + 1);
                    },
                    OP_DUP => {
                        // OP_DUP - increase by 1
                        if initial_len > 0 {
                            assert!(stack.len() == initial_len + 1);
                        }
                    },
                    OP_3DUP => {
                        // OP_3DUP - increases by 3 if stack has >= 3 items
                        if initial_len >= 3 {
                            assert!(stack.len() == initial_len + 3);
                        }
                    },
                    OP_2OVER => {
                        // OP_2OVER - increases by 2 if stack has >= 4 items
                        if initial_len >= 4 {
                            assert!(stack.len() == initial_len + 2);
                        }
                    },
                    OP_DROP | OP_NIP | OP_2DROP => {
                        // These opcodes decrease stack size
                        assert!(stack.len() <= initial_len);
                    },
                    _ => {
                        // Other opcodes maintain or modify stack size reasonably
                        // Some opcodes can push multiple items, so allow up to +3
                        assert!(stack.len() <= initial_len + 3, "Stack size should be reasonable");
                    }
                }
            }
        }
    }

    /// Property test: hash operations are deterministic
    ///
    /// Mathematical specification:
    /// ∀ input ∈ ByteString: OP_HASH160(input) = OP_HASH160(input)
    proptest! {
        #[test]
        fn prop_hash_operations_deterministic(
            input in prop::collection::vec(any::<u8>(), 0..10)
        ) {
            let elem = to_stack_element(&input);
            let mut stack1 = vec![elem.clone()];
            let mut stack2 = vec![elem];

            let result1 = execute_opcode(0xa9, &mut stack1, 0, SigVersion::Base); // OP_HASH160
            let result2 = execute_opcode(0xa9, &mut stack2, 0, SigVersion::Base); // OP_HASH160

            assert_eq!(result1.is_ok(), result2.is_ok());
            if let (Ok(val1), Ok(val2)) = (result1, result2) {
                assert_eq!(val1, val2);
                if val1 {
                    assert_eq!(stack1, stack2);
                }
            }
        }
    }

    /// Property test: equality operations are symmetric
    ///
    /// Mathematical specification:
    /// ∀ a, b ∈ ByteString: OP_EQUAL(a, b) = OP_EQUAL(b, a)
    proptest! {
        #[test]
        fn prop_equality_operations_symmetric(
            a in prop::collection::vec(any::<u8>(), 0..5),
            b in prop::collection::vec(any::<u8>(), 0..5)
        ) {
            let mut stack1 = vec![to_stack_element(&a), to_stack_element(&b)];
            let mut stack2 = vec![to_stack_element(&b), to_stack_element(&a)];

            let result1 = execute_opcode(0x87, &mut stack1, 0, SigVersion::Base); // OP_EQUAL
            let result2 = execute_opcode(0x87, &mut stack2, 0, SigVersion::Base); // OP_EQUAL

            assert_eq!(result1.is_ok(), result2.is_ok());
            if let (Ok(val1), Ok(val2)) = (result1, result2) {
                assert_eq!(val1, val2);
                if val1 {
                    // Results should be identical (both true or both false)
                    assert_eq!(stack1.len(), stack2.len());
                    if !stack1.is_empty() && !stack2.is_empty() {
                        assert_eq!(stack1[0], stack2[0]);
                    }
                }
            }
        }
    }

    /// Property test: script execution terminates
    ///
    /// Mathematical specification:
    /// ∀ script ∈ ByteString: eval_script(script) terminates (no infinite loops)
    proptest! {
        #[test]
        fn prop_script_execution_terminates(
            script in prop::collection::vec(any::<u8>(), 0..50)
        ) {
            let mut stack = Vec::new();
            let flags = 0u32;

            let _ = eval_script(&script, &mut stack, flags, SigVersion::Base);
            assert!(stack.len() <= MAX_STACK_SIZE);
        }
    }
}