diff --git a/src/dbwrapper.cpp b/src/dbwrapper.cpp
index ecc406699b32..1e6541a50664 100644
--- a/src/dbwrapper.cpp
+++ b/src/dbwrapper.cpp
@@ -427,6 +427,7 @@ Span<const std::byte> CDBIterator::GetValueImpl() const
 
 CDBIterator::~CDBIterator() = default;
 bool CDBIterator::Valid() const { return m_impl_iter->iter->Valid(); }
+bool CDBIterator::HasError() const { return !m_impl_iter->iter->status().ok(); }
 void CDBIterator::SeekToFirst() { m_impl_iter->iter->SeekToFirst(); }
 void CDBIterator::Next() { m_impl_iter->iter->Next(); }
 
diff --git a/src/dbwrapper.h b/src/dbwrapper.h
index affdb583438a..f997592fff94 100644
--- a/src/dbwrapper.h
+++ b/src/dbwrapper.h
@@ -163,6 +163,8 @@ class CDBIterator
     ~CDBIterator();
 
     bool Valid() const;
+    //! True once a read failed, e.g. on a corrupt block. Entries may then have been skipped.
+    bool HasError() const;
 
     void SeekToFirst();
 
@@ -423,6 +425,10 @@ class CDBTransactionIterator
         return transactionIt != transaction.writes.end() || parentIt->Valid();
     }
 
+    bool HasError() const {
+        return parentIt->HasError();
+    }
+
     void Next() {
         if (transactionIt == transaction.writes.end() && !parentIt->Valid()) {
             return;
diff --git a/src/interfaces/node.h b/src/interfaces/node.h
index 559746221f13..f7ce427638cb 100644
--- a/src/interfaces/node.h
+++ b/src/interfaces/node.h
@@ -273,16 +273,21 @@ class LLMQ
         int32_t m_expiry_height{0};
     };
     virtual std::vector<QuorumInfo> getQuorumStats() = 0;
-    struct PlatformQuorum {
-        uint256 m_quorum_hash{};
-        std::vector<uint8_t> m_pubkey{}; //!< serialized BLS public key (basic scheme)
-        int32_t m_height{0};
+    enum class PlatformQuorumStatus { FOUND, INVALID, UNAVAILABLE };
+    struct PlatformQuorumResult {
+        PlatformQuorumStatus status{PlatformQuorumStatus::UNAVAILABLE};
+        std::vector<uint8_t> public_key; //!< 48-byte basic-scheme key for FOUND; empty otherwise
     };
-    //! Locally retained quorums of the given LLMQ type with their public
-    //! keys. Used by the GUI Platform client to verify Platform state-root
-    //! quorum signatures against locally synced quorum data. This includes
-    //! retained signing quorums that are no longer in the active signing set.
-    virtual std::vector<PlatformQuorum> getPlatformQuorums(uint8_t llmq_type) = 0;
+    //! Whether `quorum_hash` (Core internal byte order) could sign Platform state whose signed metadata
+    //! carries `core_chain_locked_height`, judged from this node's active chain. FOUND means it is among
+    //! the quorums eligible at that height. INVALID means the local chain proves it could not: the
+    //! height is stale against a ChainLock this node knows, or the hash is no block of the active chain
+    //! below that height, so no quorum with it was mined by then, which counts only if the active
+    //! chain's block at that height is, or is an ancestor of, the block of the best ChainLock whose
+    //! block this node knows. UNAVAILABLE means this node proves neither, as for an older quorum, which
+    //! may still sign the one Platform block that first carries a height after a jump.
+    virtual PlatformQuorumResult getPlatformQuorum(uint8_t llmq_type, const uint256& quorum_hash,
+                                                   uint32_t core_chain_locked_height) = 0;
     //! Serialized InstantSend lock for the given txid, or empty if the
     //! transaction has no islock (used to build asset lock proofs).
     virtual std::vector<uint8_t> getInstantSendLock(const uint256& txid) = 0;
diff --git a/src/llmq/blockprocessor.cpp b/src/llmq/blockprocessor.cpp
index f8442e093ab4..a97513130101 100644
--- a/src/llmq/blockprocessor.cpp
+++ b/src/llmq/blockprocessor.cpp
@@ -17,6 +17,8 @@
 #include <checkqueue.h>
 #include <consensus/params.h>
 #include <consensus/validation.h>
+#include <crypto/common.h>
+#include <dbwrapper.h>
 #include <deploymentstatus.h>
 #include <net.h>
 #include <primitives/block.h>
@@ -833,6 +835,111 @@ std::vector<const CBlockIndex*> CQuorumBlockProcessor::GetMinedCommitmentsIndexe
     return ret;
 }
 
+// Appends quorum bases from one inversed-height index, newest first, until `bases` holds
+// `max_count` entries. Returns false if an entry inside `prefix` could not be read or contradicts
+// the index, keeping the entries before it that the contradiction does not implicate; a key outside
+// `prefix` ends the walk because no older entry exists.
+static bool ReadMinedCommitmentIndex(CEvoDB& evo_db, const DataStream& prefix, const CBlockIndex& pindex,
+                                     size_t max_count, std::vector<const CBlockIndex*>& bases)
+{
+    AssertLockNotHeld(evo_db.cs);
+    LOCK(evo_db.cs);
+
+    const auto unreadable{[&](const char* reason) {
+        LogPrint(BCLog::LLMQ, "Mined commitment index below height %d unreadable after %d entries: %s\n",
+                 pindex.nHeight, bases.size(), reason);
+        return false;
+    }};
+
+    DataStream first_key{prefix};
+    first_key << htobe32_internal(std::numeric_limits<uint32_t>::max() - pindex.nHeight);
+
+    auto it{evo_db.GetCurTransaction().NewIteratorUniquePtr()};
+    try {
+        for (it->Seek(first_key); bases.size() < max_count; it->Next()) {
+            // The iterator steps over a block it cannot read, so later entries are not the next newest.
+            if (it->HasError()) return unreadable("read error");
+            if (!it->Valid()) break;
+            const DataStream key{it->GetKey()};
+            if (key.size() < prefix.size() || !std::equal(prefix.begin(), prefix.end(), key.begin())) {
+                break;
+            }
+            int base_height{-1};
+            if (key.size() != prefix.size() + sizeof(uint32_t) || !it->GetValue(base_height)) {
+                return unreadable("malformed entry");
+            }
+            const int64_t mined_height{std::numeric_limits<uint32_t>::max() -
+                                       be32toh_internal(ReadLE32(UCharCast(key.data() + prefix.size())))};
+            const CBlockIndex* base{pindex.GetAncestor(base_height)};
+            if (!base || base_height >= mined_height) return unreadable("inconsistent entry");
+            // A commitment is mined within its own quorum's DKG interval, so along one index the
+            // quorum bases strictly decrease. Either of the two entries may be the wrong one.
+            if (!bases.empty() && base_height >= bases.back()->nHeight) {
+                bases.pop_back();
+                return unreadable("out-of-order entry");
+            }
+            bases.push_back(base);
+        }
+    } catch (const dbwrapper_error& e) {
+        return unreadable(e.what());
+    }
+    return true;
+}
+
+MinedCommitmentScan CQuorumBlockProcessor::ScanMinedCommitmentsUntilBlock(Consensus::LLMQType llmqType,
+                                                                          gsl::not_null<const CBlockIndex*> pindex,
+                                                                          size_t max_count) const
+{
+    DataStream prefix{};
+    prefix << DB_MINED_COMMITMENT_BY_INVERSED_HEIGHT << llmqType;
+    MinedCommitmentScan scan;
+    scan.complete = ReadMinedCommitmentIndex(m_evoDb, prefix, *pindex, max_count, scan.bases);
+    return scan;
+}
+
+MinedCommitmentScan CQuorumBlockProcessor::ScanMinedCommitmentsIndexedUntilBlock(Consensus::LLMQType llmqType,
+                                                                                 gsl::not_null<const CBlockIndex*> pindex,
+                                                                                 size_t max_count) const
+{
+    MinedCommitmentScan scan;
+    const auto llmq_params{Params().GetLLMQ(llmqType)};
+    if (!Assume(llmq_params.has_value())) {
+        return scan;
+    }
+    // Cycle by cycle, the cycle-th newest commitment of every quorum index in index order.
+    std::vector<std::vector<const CBlockIndex*>> taken(llmq_params->signingActiveQuorumCount);
+    for (size_t cycle{0}; scan.bases.size() < max_count; ++cycle) {
+        const size_t found_before{scan.bases.size()};
+        for (const int quorum_index : util::irange(llmq_params->signingActiveQuorumCount)) {
+            if (scan.bases.size() == max_count) break;
+            DataStream prefix{};
+            prefix << DB_MINED_COMMITMENT_BY_INVERSED_HEIGHT_Q_INDEXED << llmqType << quorum_index;
+            std::vector<const CBlockIndex*> index_bases;
+            if (!ReadMinedCommitmentIndex(m_evoDb, prefix, *pindex, cycle + 1, index_bases)) {
+                // Earlier cycles took this index's newer entries; drop any the failed read no longer keeps.
+                for (size_t rank{index_bases.size()}; rank < taken[quorum_index].size(); ++rank) {
+                    std::erase(scan.bases, taken[quorum_index][rank]);
+                }
+                return scan;
+            }
+            if (index_bases.size() > cycle) {
+                // Quorums of different quorum indexes have different base blocks, so either entry may
+                // be the wrong one.
+                if (std::erase(scan.bases, index_bases[cycle]) > 0) {
+                    LogPrint(BCLog::LLMQ, "Mined commitment index of quorum index %d repeats base height %d\n",
+                             quorum_index, index_bases[cycle]->nHeight);
+                    return scan;
+                }
+                scan.bases.push_back(index_bases[cycle]);
+            }
+            taken[quorum_index] = std::move(index_bases);
+        }
+        if (scan.bases.size() == found_before) break;
+    }
+    scan.complete = true;
+    return scan;
+}
+
 // The returned quorums are in reversed order, so the most recent one is at index 0
 std::map<Consensus::LLMQType, std::vector<const CBlockIndex*>> CQuorumBlockProcessor::GetMinedAndActiveCommitmentsUntilBlock(gsl::not_null<const CBlockIndex*> pindex) const
 {
diff --git a/src/llmq/blockprocessor.h b/src/llmq/blockprocessor.h
index f506a3c99deb..790247390387 100644
--- a/src/llmq/blockprocessor.h
+++ b/src/llmq/blockprocessor.h
@@ -22,6 +22,7 @@
 #include <functional>
 #include <memory>
 #include <optional>
+#include <vector>
 
 class BlockValidationState;
 class CBlock;
@@ -47,6 +48,17 @@ using QcHashMap = std::map<Consensus::LLMQType, std::vector<uint256>>;
 //! As above, but keyed by quorumIndex, for rotation-enabled types.
 using QcIndexedHashMap = std::map<Consensus::LLMQType, std::map<int16_t, uint256>>;
 
+struct MinedCommitmentScan {
+    //! Quorum base blocks of mined commitments. Non-indexed scans return them newest first. Indexed
+    //! scans return them by cycle rank, newest rank first, and by quorum index within each rank.
+    std::vector<const CBlockIndex*> bases;
+    //! True if `bases` holds the requested number of entries or every older entry was read; false
+    //! if an index entry could not be read or contradicts another, so an absent quorum may still
+    //! have been mined. Entries a contradiction implicates are left out. A wrong entry that fits
+    //! the index's order is not detected.
+    bool complete{false};
+};
+
 /** Erase a mined commitment unless another chainstate still contains its block. */
 bool EraseMinedCommitmentIfUnreferenced(CEvoDB& evo_db, const Chainstate& chainstate,
                                         gsl::not_null<const CBlockIndex*> pindex,
@@ -155,6 +167,16 @@ class CQuorumBlockProcessor
                                                                                     const CBlockIndex* pindex,
                                                                                     size_t cycle) const;
     std::optional<const CBlockIndex*> GetLastMinedCommitmentsByQuorumIndexUntilBlock(Consensus::LLMQType llmqType, const CBlockIndex* pindex, int quorumIndex, size_t cycle) const;
+
+    //! GetMinedCommitmentsUntilBlock, stopping at an entry it cannot read or trust and reporting
+    //! whether the walk read every entry it needed.
+    MinedCommitmentScan ScanMinedCommitmentsUntilBlock(Consensus::LLMQType llmqType,
+                                                       gsl::not_null<const CBlockIndex*> pindex, size_t max_count) const;
+    //! GetMinedCommitmentsIndexedUntilBlock for rotation-enabled types, reporting the same way.
+    MinedCommitmentScan ScanMinedCommitmentsIndexedUntilBlock(Consensus::LLMQType llmqType,
+                                                              gsl::not_null<const CBlockIndex*> pindex,
+                                                              size_t max_count) const;
+
 private:
     //! Called from every site that writes or erases mined commitment state.
     void DropQcHashesCache() EXCLUSIVE_LOCKS_REQUIRED(!m_qc_hashes_cache_mutex);
diff --git a/src/llmq/params.h b/src/llmq/params.h
index 2c975d828cb8..b9701e7f46f7 100644
--- a/src/llmq/params.h
+++ b/src/llmq/params.h
@@ -5,6 +5,7 @@
 #ifndef BITCOIN_LLMQ_PARAMS_H
 #define BITCOIN_LLMQ_PARAMS_H
 
+#include <algorithm>
 #include <array>
 #include <cstdint>
 #include <string_view>
@@ -512,6 +513,35 @@ static constexpr std::array<LLMQParams, 14> available_llmqs = {
 
 } // namespace Consensus
 
+namespace llmq {
+//! DKG intervals beyond its signing-active period during which a Platform quorum is still accepted
+//! as the signer of Platform state.
+static constexpr int PLATFORM_QUORUM_SLACK{2};
+
+//! DKG intervals during which a Platform quorum may sign Platform state. A quorum of a non-rotating
+//! type is signing-active for signingActiveQuorumCount intervals, one of a rotating type for one.
+[[nodiscard]] constexpr int PlatformEligibleIntervals(const Consensus::LLMQParams& params)
+{
+    return (params.useRotation ? 1 : params.signingActiveQuorumCount) + PLATFORM_QUORUM_SLACK;
+}
+
+//! How many of the newest mined Platform quorums may sign Platform state. A non-rotating type mines
+//! one quorum per DKG interval, a rotating type one per quorum index.
+[[nodiscard]] constexpr int PlatformEligibleQuorumCount(const Consensus::LLMQParams& params)
+{
+    return PlatformEligibleIntervals(params) * (params.useRotation ? params.signingActiveQuorumCount : 1);
+}
+
+//! Lowest Core chain-locked height that Platform state may carry for this node to verify its
+//! quorum signature, given the node's ChainLock height. Bounding by the ChainLock rather than the
+//! tip keeps state signed before a ChainLock stall verifiable while the tip keeps moving.
+[[nodiscard]] constexpr int PlatformQuorumMinSignedHeight(const Consensus::LLMQParams& params, int cl_height)
+{
+    const int64_t window{int64_t{PlatformEligibleIntervals(params)} * params.dkgInterval};
+    return static_cast<int>(std::max<int64_t>(0, int64_t{cl_height} - window));
+}
+} // namespace llmq
+
 // This must be outside of all namespaces. We must also duplicate the forward declaration of is_serializable_enum to
 // avoid inclusion of serialize.h here.
 template<typename T> struct is_serializable_enum;
diff --git a/src/node/interfaces.cpp b/src/node/interfaces.cpp
index a12196d561e9..170c9502967b 100644
--- a/src/node/interfaces.cpp
+++ b/src/node/interfaces.cpp
@@ -13,6 +13,7 @@
 #include <chainparams.h>
 #include <coinjoin/common.h>
 #include <common/system.h>
+#include <dbwrapper.h>
 #include <deploymentstatus.h>
 #include <evo/creditpool.h>
 #include <evo/deterministicmns.h>
@@ -37,6 +38,7 @@
 #include <llmq/commitment.h>
 #include <llmq/context.h>
 #include <llmq/options.h>
+#include <llmq/params.h>
 #include <llmq/quorums.h>
 #include <llmq/quorumsman.h>
 #include <logging.h>
@@ -86,6 +88,7 @@
 #include <boost/signals2/signal.hpp>
 
 #include <algorithm>
+#include <limits>
 #include <memory>
 #include <optional>
 #include <ranges>
@@ -684,44 +687,79 @@ class LLMQImpl : public LLMQ
         }
         return stats;
     }
-    std::vector<PlatformQuorum> getPlatformQuorums(uint8_t llmq_type) override
+    PlatformQuorumResult getPlatformQuorum(uint8_t llmq_type, const uint256& quorum_hash,
+                                           uint32_t core_chain_locked_height) override
     {
-        std::vector<PlatformQuorum> ret;
+        PlatformQuorumResult invalid{PlatformQuorumStatus::INVALID, {}};
+        const auto type{static_cast<Consensus::LLMQType>(llmq_type)};
+        const auto llmq_params{Params().GetLLMQ(type)};
+        if (type != Params().GetConsensus().llmqTypePlatform || !llmq_params.has_value()) {
+            return invalid;
+        }
+        if (core_chain_locked_height > static_cast<uint32_t>(std::numeric_limits<int32_t>::max())) {
+            return invalid;
+        }
+        const int signed_height{static_cast<int>(core_chain_locked_height)};
         if (!context().llmq_ctx || !context().llmq_ctx->quorum_block_processor || !context().chainman) {
-            return ret;
+            return {};
         }
-        const auto* pindex{WITH_LOCK(::cs_main, return context().chainman->ActiveChain().Tip())};
-        if (!pindex) {
-            return ret;
+        // Only a ChainLock whose block is known can lock part of the active chain; the best height may
+        // belong to a block this node has not seen.
+        const CBlockIndex* chainlocked_block{nullptr};
+        int32_t best_cl_height{-1};
+        if (const auto& chainlocks{context().chainlocks}) {
+            chainlocked_block = chainlocks->GetBestChainlockWithPindex().second;
+            best_cl_height = chainlocks->GetBestChainLockHeight();
         }
-        const auto type{static_cast<Consensus::LLMQType>(llmq_type)};
-        const auto llmq_params{Params().GetLLMQ(type)};
-        if (!llmq_params.has_value()) {
-            return ret;
+
+        LOCK(::cs_main);
+        const CChain& active{context().chainman->ActiveChain()};
+        const CBlockIndex* tip{active.Tip()};
+        if (!tip || signed_height > tip->nHeight) {
+            return {};
         }
-        // Drive proofs may be signed by an older Platform quorum while they
-        // are still consensus-valid and retained locally. Export the full
-        // retained-key window, not only the current signing-active set.
-        const auto quorum_count{static_cast<size_t>(std::max(llmq_params->signingActiveQuorumCount,
-                                                             llmq_params->keepOldKeys))};
-        // Read mined final commitments directly: they already carry the quorum
-        // hash and public key, so there is no need to materialize full CQuorum
-        // objects (member lists, vvec/contribution reads, quorum cache inserts)
-        // via ScanQuorums. Newest-first, matching ScanQuorums' ordering.
+        // A ChainLock can arrive before its block. Without one the tip still proves a height fresh,
+        // but not stale: Platform may carry a ChainLock this node has not learned yet.
+        const int cl_height{best_cl_height >= 0 ? std::min(best_cl_height, tip->nHeight) : tip->nHeight};
+        if (signed_height < llmq::PlatformQuorumMinSignedHeight(*llmq_params, cl_height)) {
+            return best_cl_height >= 0 ? invalid : PlatformQuorumResult{};
+        }
+
         const auto& qbp{*context().llmq_ctx->quorum_block_processor};
-        const auto quorum_base_block_indexes{llmq_params->useRotation
-            ? qbp.GetMinedCommitmentsIndexedUntilBlock(type, pindex, quorum_count)
-            : qbp.GetMinedCommitmentsUntilBlock(type, pindex, quorum_count)};
-        for (const auto* pQuorumBaseBlockIndex : quorum_base_block_indexes) {
-            const auto qc{qbp.GetMinedCommitment(type, pQuorumBaseBlockIndex->GetBlockHash()).first};
-            if (!qc.quorumPublicKey.IsValid()) continue;
-            ret.emplace_back(PlatformQuorum{
-                .m_quorum_hash = qc.quorumHash,
-                .m_pubkey = qc.quorumPublicKey.ToByteVector(/*specificLegacyScheme=*/false),
-                .m_height = pQuorumBaseBlockIndex->nHeight,
-            });
+        const CBlockIndex* signed_block{active[signed_height]};
+        const auto window{static_cast<size_t>(llmq::PlatformEligibleQuorumCount(*llmq_params))};
+        const auto scan{llmq_params->useRotation ? qbp.ScanMinedCommitmentsIndexedUntilBlock(type, signed_block, window)
+                                                 : qbp.ScanMinedCommitmentsUntilBlock(type, signed_block, window)};
+        if (std::ranges::none_of(scan.bases, [&](const CBlockIndex* base) { return base->GetBlockHash() == quorum_hash; })) {
+            // Platform verifies a block against its last committed validator set, so the block that
+            // first carries a height may be signed by a quorum no longer in the window at that height.
+            // A quorum mined at or below the height has its base block on the active chain below it;
+            // any other hash could never have signed.
+            const CBlockIndex* base{context().chainman->m_blockman.LookupBlockIndex(quorum_hash)};
+            const bool never_mined{!base || base->nHeight >= signed_height || !active.Contains(base)};
+            // That is final only on the part of the active chain a ChainLock locks; beyond it the
+            // active chain may be a competing branch. Unlike Chainlocks::HasChainLock, this keeps the
+            // lock while spork 19 is off. A node whose quorum index reads as corrupt may have bad storage
+            // elsewhere too, so it rejects nothing until the window reads cleanly.
+            const bool chainlocked{chainlocked_block && chainlocked_block->GetAncestor(signed_height) == signed_block};
+            return never_mined && chainlocked && scan.complete ? invalid : PlatformQuorumResult{};
         }
-        return ret;
+
+        // Mined commitments passed consensus validation, so an unreadable or inconsistent record is
+        // local corruption, not evidence against the quorum.
+        std::pair<llmq::CFinalCommitment, uint256> record;
+        try {
+            record = qbp.GetMinedCommitment(type, quorum_hash);
+        } catch (const dbwrapper_error&) {
+            return {};
+        }
+        const auto& [qc, mined_block_hash]{record};
+        const CBlockIndex* mined_block{context().chainman->m_blockman.LookupBlockIndex(mined_block_hash)};
+        if (qc.llmqType != type || qc.quorumHash != quorum_hash || !mined_block || !active.Contains(mined_block) ||
+            mined_block->nHeight > signed_height || !qc.quorumPublicKey.IsValid()) {
+            return {};
+        }
+        return {PlatformQuorumStatus::FOUND, qc.quorumPublicKey.ToByteVector(/*specificLegacyScheme=*/false)};
     }
     std::vector<uint8_t> getInstantSendLock(const uint256& txid) override
     {
diff --git a/src/test/interfaces_tests.cpp b/src/test/interfaces_tests.cpp
index 2bdca0b6f459..2a9d9fbf06f1 100644
--- a/src/test/interfaces_tests.cpp
+++ b/src/test/interfaces_tests.cpp
@@ -3,6 +3,7 @@
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <bls/bls.h>
+#include <chainlock/chainlock.h>
 #include <chainparams.h>
 #include <consensus/validation.h>
 #include <evo/evodb.h>
@@ -13,21 +14,30 @@
 #include <interfaces/node.h>
 #include <llmq/commitment.h>
 #include <llmq/context.h>
+#include <llmq/options.h>
+#include <llmq/params.h>
 #include <script/standard.h>
 #include <spork.h>
 #include <streams.h>
 #include <test/util/llmq_tests.h>
 #include <test/util/setup_common.h>
+#include <tinyformat.h>
+#include <util/fs.h>
 #include <util/std23.h>
 #include <util/strencodings.h>
 #include <validation.h>
 #include <version.h>
 
 #include <algorithm>
-#include <array>
 #include <chrono>
 #include <future>
+#include <map>
+#include <memory>
+#include <string>
+#include <string_view>
 #include <thread>
+#include <utility>
+#include <vector>
 
 #include <boost/test/unit_test.hpp>
 
@@ -339,75 +349,374 @@ BOOST_AUTO_TEST_CASE(hasBlocks)
     BOOST_CHECK(!chain->hasBlocks(active.Tip()->GetBlockHash(), 6, 50));
 }
 
-// getPlatformQuorums exports the retained-key window of mined commitments with basic-scheme
-// serialized public keys, newest-first. Mined commitments are installed directly in EvoDB (the
-// same shortcut evo_cbtx_tests uses) since a real DKG cannot run in a unit test.
-BOOST_AUTO_TEST_CASE(getPlatformQuorums)
+namespace {
+using PlatformQuorumStatus = interfaces::LLMQ::PlatformQuorumStatus;
+
+const char* StatusName(PlatformQuorumStatus status)
+{
+    switch (status) {
+    case PlatformQuorumStatus::FOUND: return "FOUND";
+    case PlatformQuorumStatus::INVALID: return "INVALID";
+    case PlatformQuorumStatus::UNAVAILABLE: return "UNAVAILABLE";
+    }
+    return "?";
+}
+
+interfaces::LLMQ::PlatformQuorumResult CheckPlatformQuorum(interfaces::LLMQ& llmq, std::string_view label,
+                                                           uint8_t llmq_type, const uint256& quorum_hash,
+                                                           uint32_t height, PlatformQuorumStatus expected)
+{
+    auto result{llmq.getPlatformQuorum(llmq_type, quorum_hash, height)};
+    BOOST_CHECK_MESSAGE(result.status == expected, strprintf("%s (height %u): got %s, expected %s", label, height,
+                                                             StatusName(result.status), StatusName(expected)));
+    BOOST_CHECK_MESSAGE(result.public_key.empty() == (result.status != PlatformQuorumStatus::FOUND),
+                        strprintf("%s: only FOUND carries a key", label));
+    return result;
+}
+
+// Records a ChainLock at `height` on `block`, or on a block this node does not know if null.
+void RecordChainLock(chainlock::Chainlocks& chainlocks, int height, const CBlockIndex* block)
+{
+    const auto clsig{llmq::testutils::CreateChainLock(height, block ? block->GetBlockHash() : InsecureRand256())};
+    BOOST_REQUIRE(chainlocks.UpdateBestChainlock(::SerializeHash(clsig), clsig, block));
+}
+
+// Adds a header-only block on `prev`, unique and otherwise copied from `like`.
+const CBlockIndex* AddHeader(ChainstateManager& chainman, const CBlockIndex& prev, const CBlockIndex& like)
+    EXCLUSIVE_LOCKS_REQUIRED(::cs_main)
+{
+    CBlockHeader header{like.GetBlockHeader()};
+    header.hashPrevBlock = prev.GetBlockHash();
+    ++header.nNonce;
+    return chainman.m_blockman.AddToBlockIndex(header, header.GetHash(), chainman.m_best_header);
+}
+} // namespace
+
+// getPlatformQuorum answers whether a quorum could have signed Platform state carrying a given Core
+// chain-locked height. Mined commitments are installed directly in EvoDB (the same shortcut
+// evo_cbtx_tests uses) since a real DKG cannot run in a unit test. After the first checks a
+// ChainLock on the tip covers the whole active chain, and the staleness bound equals the tip's.
+BOOST_AUTO_TEST_CASE(getPlatformQuorum)
 {
     auto node{interfaces::MakeNode(m_node)};
-    constexpr auto llmq_type{Consensus::LLMQType::LLMQ_TEST};
-    const auto llmq_params{Params().GetLLMQ(llmq_type)};
-    BOOST_REQUIRE(llmq_params.has_value());
-
-    // The exported window is the retained-key window, which on LLMQ_TEST is strictly larger than
-    // the active signing set: older quorums may still have signed consensus-valid Platform state
-    // roots, so exporting only the active set would be a regression.
-    const auto window{static_cast<size_t>(std::max(llmq_params->signingActiveQuorumCount, llmq_params->keepOldKeys))};
-    BOOST_REQUIRE_EQUAL(window, 4U);
-    BOOST_REQUIRE(window > static_cast<size_t>(llmq_params->signingActiveQuorumCount));
-
-    // No commitments yet.
-    BOOST_CHECK(node->llmq().getPlatformQuorums(std23::to_underlying(llmq_type)).empty());
-    // Unconfigured LLMQ type.
-    BOOST_CHECK(node->llmq().getPlatformQuorums(0xEE).empty());
-
-    // One more valid commitment than the window can hold, quorum bases at heights 10..50.
-    constexpr std::array<int, 5> base_heights{10, 20, 30, 40, 50};
-    std::vector<llmq::CFinalCommitment> qcs;
+    auto& llmq{node->llmq()};
+    const auto platform_type{Params().GetConsensus().llmqTypePlatform};
+    BOOST_REQUIRE(platform_type == Consensus::LLMQType::LLMQ_TEST_PLATFORM);
+    const auto& params{llmq::testutils::GetLLMQParams(platform_type)};
+    const uint8_t type{std23::to_underlying(platform_type)};
+    // Four commitments are eligible at any height (signingActiveQuorumCount plus a slack of two) and
+    // state older than 4 * 24 = 96 blocks below the ChainLock is stale.
+    BOOST_REQUIRE_EQUAL(params.signingActiveQuorumCount, 2);
+    BOOST_REQUIRE_EQUAL(params.dkgInterval, 24);
+    const int tip{WITH_LOCK(::cs_main, return m_node.chainman->ActiveChain().Height())};
+    BOOST_REQUIRE_EQUAL(tip, 100);
+    BOOST_REQUIRE_EQUAL(llmq::PlatformQuorumMinSignedHeight(params, tip), 4);
+
+    // Quorum bases mined one block later: 2 (mined at 3), 10, 20, 30, 40, 50 (mined at 51).
+    std::map<int, llmq::CFinalCommitment> qcs;
+    llmq::CFinalCommitment other_type_qc;
     {
-        LOCK(Assert(m_node.chainman)->GetMutex());
+        LOCK(::cs_main);
         const CChain& active{m_node.chainman->ActiveChain()};
         auto db_tx{m_node.evodb->BeginTransaction()};
-        for (const int base : base_heights) {
-            auto qc{llmq::testutils::CreateValidCommitment(*llmq_params, active[base]->GetBlockHash())};
+        for (const int base : {2, 10, 20, 30, 40, 50}) {
+            auto qc{llmq::testutils::CreateValidCommitment(params, active[base]->GetBlockHash())};
             llmq::testutils::WriteMinedCommitment(*m_node.evodb, qc, active[base + 1]->GetBlockHash(),
                                                   /*mined_height=*/base + 1, /*quorum_height=*/base);
-            qcs.push_back(qc);
+            qcs.emplace(base, qc);
         }
+        other_type_qc = llmq::testutils::CreateValidCommitment(llmq::testutils::GetLLMQParams(Consensus::LLMQType::LLMQ_TEST),
+                                                               active[60]->GetBlockHash());
+        llmq::testutils::WriteMinedCommitment(*m_node.evodb, other_type_qc, active[61]->GetBlockHash(),
+                                              /*mined_height=*/61, /*quorum_height=*/60);
         db_tx->Commit();
     }
-
-    const auto check_quorums = [&](const std::vector<interfaces::LLMQ::PlatformQuorum>& quorums,
-                                   const std::vector<size_t>& expected_qc_indexes) {
-        BOOST_REQUIRE_EQUAL(quorums.size(), expected_qc_indexes.size());
-        for (size_t i{0}; i < quorums.size(); ++i) {
-            const auto& qc{qcs[expected_qc_indexes[i]]};
-            BOOST_CHECK_EQUAL(quorums[i].m_quorum_hash, qc.quorumHash);
-            BOOST_CHECK_EQUAL(quorums[i].m_height, base_heights[expected_qc_indexes[i]]);
-            // Exact basic-scheme serialization, regardless of the active global BLS scheme.
-            BOOST_CHECK(quorums[i].m_pubkey == qc.quorumPublicKey.ToByteVector(/*specificLegacyScheme=*/false));
-            CBLSPublicKey roundtrip;
-            roundtrip.SetBytes(quorums[i].m_pubkey, /*specificLegacyScheme=*/false);
-            BOOST_CHECK(roundtrip.IsValid());
-            BOOST_CHECK(roundtrip == qc.quorumPublicKey);
-        }
+    const auto check = [&](std::string_view label, uint8_t llmq_type, const uint256& hash, uint32_t height,
+                           PlatformQuorumStatus expected) {
+        return CheckPlatformQuorum(llmq, label, llmq_type, hash, height, expected);
     };
+    using enum PlatformQuorumStatus;
+
+    // The newest quorum, with the commitment's 48-byte basic-scheme key. The hash is in Core's
+    // internal byte order.
+    const auto found{check("newest", type, qcs.at(50).quorumHash, tip, FOUND)};
+    BOOST_CHECK(found.public_key == qcs.at(50).quorumPublicKey.ToByteVector(/*specificLegacyScheme=*/false));
+    BOOST_CHECK_EQUAL(found.public_key.size(), 48U);
+    CBLSPublicKey roundtrip;
+    roundtrip.SetBytes(found.public_key, /*specificLegacyScheme=*/false);
+    BOOST_CHECK(roundtrip.IsValid());
+    BOOST_CHECK(roundtrip == qcs.at(50).quorumPublicKey);
+    // Without a ChainLock this node's chain is not final, so a missing quorum is not evidence yet.
+    check("unknown quorum, no ChainLock", type, InsecureRand256(), tip, UNAVAILABLE);
+
+    // Base 2 is eligible at heights 3 and 4; only 4 is within the staleness bound the tip gives. With
+    // no ChainLock known, as after a restart during a ChainLock stall, the tip does not prove 3 stale:
+    // Platform may carry the stalled ChainLock (see "stalled ChainLock learned").
+    check("at the staleness bound", type, qcs.at(2).quorumHash, 4, FOUND);
+    check("below the tip's staleness bound, no ChainLock", type, qcs.at(2).quorumHash, 3, UNAVAILABLE);
+
+    const auto* tip_block{WITH_LOCK(::cs_main, return m_node.chainman->ActiveChain().Tip())};
+    RecordChainLock(*m_node.chainlocks, tip, tip_block);
+    check("below the staleness bound", type, qcs.at(2).quorumHash, 3, INVALID);
+
+    uint256 reversed{qcs.at(50).quorumHash};
+    std::reverse(reversed.begin(), reversed.end());
+    check("byte-reversed hash", type, reversed, tip, INVALID);
+
+    // Window edges at the tip, newest first: 50, 40, 30, 20 are eligible and 10 is fifth.
+    check("position 3", type, qcs.at(30).quorumHash, tip, FOUND);
+    check("position 4", type, qcs.at(20).quorumHash, tip, FOUND);
+    // Base 10 is fourth at height 50. When Platform's Core height jumps from 50 to the tip, its
+    // validator set signs the first block carrying the tip's height, so fifth proves nothing.
+    check("position 4 before a Core-height jump", type, qcs.at(10).quorumHash, 50, FOUND);
+    check("position 5 after a Core-height jump", type, qcs.at(10).quorumHash, tip, UNAVAILABLE);
+
+    // A quorum stays valid for state signed while it was in the window.
+    check("historical", type, qcs.at(10).quorumHash, 15, FOUND);
+    // Only bases 10 and 2 were mined by height 15, and nothing older exists.
+    check("unknown quorum, window shorter than four", type, InsecureRand256(), 15, INVALID);
+
+    check("height above the tip", type, qcs.at(50).quorumHash, tip + 1, UNAVAILABLE);
+    check("height beyond int32", type, qcs.at(50).quorumHash, uint32_t{1} << 31, INVALID);
+    check("non-Platform type", std23::to_underlying(Consensus::LLMQType::LLMQ_TEST), other_type_qc.quorumHash, tip,
+          INVALID);
+    check("unknown type", 0xEE, qcs.at(50).quorumHash, tip, INVALID);
+    check("unknown quorum", type, InsecureRand256(), tip, INVALID);
+    check("mined above the height", type, qcs.at(50).quorumHash, 50, INVALID);
+    // A quorum that could sign at a height has its base block on the active chain below it.
+    uint256 block_45, block_70, off_chain;
+    {
+        LOCK(::cs_main);
+        const CChain& active{m_node.chainman->ActiveChain()};
+        block_45 = active[45]->GetBlockHash();
+        block_70 = active[70]->GetBlockHash();
+        off_chain = AddHeader(*m_node.chainman, *active[50], *active[51])->GetBlockHash();
+    }
+    check("block above the height", type, block_70, 50, INVALID);
+    check("block off the active chain", type, off_chain, tip, INVALID);
+    check("block below the height, outside the window", type, block_45, tip, UNAVAILABLE);
+
+    // ChainLocks stalled at 50 while the tip reached 100: the staleness bound follows the ChainLock.
+    // Height 3, unproven without a ChainLock above, is fresh once this node learns the stalled one.
+    m_node.chainlocks->ResetChainlock();
+    const auto* block_50{WITH_LOCK(::cs_main, return m_node.chainman->ActiveChain()[50])};
+    RecordChainLock(*m_node.chainlocks, 50, block_50);
+    check("stalled ChainLock learned", type, qcs.at(2).quorumHash, 3, FOUND);
+    // Above the ChainLock the active chain may be a competing branch that lacks the newest
+    // commitment, so only a quorum found there is decisive.
+    check("unknown quorum at the ChainLock", type, InsecureRand256(), 50, INVALID);
+    check("unknown quorum above the ChainLock", type, InsecureRand256(), 51, UNAVAILABLE);
+    check("unknown quorum far above the ChainLock", type, InsecureRand256(), 86, UNAVAILABLE);
+    check("above the ChainLock", type, qcs.at(50).quorumHash, 86, FOUND);
+    // A higher ChainLock on a block this node does not know covers nothing yet.
+    RecordChainLock(*m_node.chainlocks, 88, nullptr);
+    check("unknown quorum below a ChainLock on an unknown block", type, InsecureRand256(), 86, UNAVAILABLE);
+    // One on a branch forking from the active chain after block 83 covers the active chain to 83.
+    const CBlockIndex* branch_tip;
+    {
+        LOCK(::cs_main);
+        const CChain& active{m_node.chainman->ActiveChain()};
+        branch_tip = active[83];
+        for (int height{84}; height <= 90; ++height) {
+            branch_tip = AddHeader(*m_node.chainman, *branch_tip, *active[height]);
+        }
+        BOOST_REQUIRE(!active.Contains(branch_tip));
+    }
+    RecordChainLock(*m_node.chainlocks, 90, branch_tip);
+    check("unknown quorum above a competing ChainLock's fork", type, InsecureRand256(), 86, UNAVAILABLE);
+    check("unknown quorum below a competing ChainLock's fork", type, InsecureRand256(), 83, INVALID);
+    // One on a header built on the tip covers the whole active chain before its block arrives.
+    const auto* next_header{WITH_LOCK(::cs_main, return AddHeader(*m_node.chainman, *tip_block, *tip_block))};
+    RecordChainLock(*m_node.chainlocks, tip + 1, next_header);
+    check("unknown quorum below a ChainLock beyond the tip", type, InsecureRand256(), tip, INVALID);
+
+    // A ChainLock on a block not known yet still raises the staleness bound, but only up to the tip.
+    m_node.chainlocks->ResetChainlock();
+    RecordChainLock(*m_node.chainlocks, 50, block_50);
+    RecordChainLock(*m_node.chainlocks, 1000, nullptr);
+    check("ChainLock ahead of the tip, at the bound", type, qcs.at(2).quorumHash, 4, FOUND);
+    check("ChainLock ahead of the tip, below the bound", type, qcs.at(2).quorumHash, 3, INVALID);
+}
 
-    // Newest-first and truncated to the window: bases 50, 40, 30, 20; base 10 falls out.
-    check_quorums(node->llmq().getPlatformQuorums(std23::to_underlying(llmq_type)), {4, 3, 2, 1});
+// A window entry this node cannot read or trust is a local fault. Mined commitments passed consensus
+// validation, so the answer is UNAVAILABLE, never INVALID. A ChainLock on the tip makes a missing
+// quorum INVALID unless a fault is in the way.
+BOOST_AUTO_TEST_CASE(getPlatformQuorum_local_faults)
+{
+    auto node{interfaces::MakeNode(m_node)};
+    auto& llmq{node->llmq()};
+    const auto platform_type{Params().GetConsensus().llmqTypePlatform};
+    const auto& params{llmq::testutils::GetLLMQParams(platform_type)};
+    const uint8_t type{std23::to_underlying(platform_type)};
 
-    // A commitment whose public key is invalid consumes its window slot but exports nothing.
+    std::vector<uint256> hashes;
     {
-        LOCK(Assert(m_node.chainman)->GetMutex());
+        LOCK(::cs_main);
         const CChain& active{m_node.chainman->ActiveChain()};
-        auto qc{llmq::testutils::CreateValidCommitment(*llmq_params, active[60]->GetBlockHash())};
-        qc.quorumPublicKey = CBLSPublicKey{};
+        RecordChainLock(*m_node.chainlocks, active.Height(), active.Tip());
+        for (int height{0}; height <= active.Height(); ++height) {
+            hashes.push_back(active[height]->GetBlockHash());
+        }
         auto db_tx{m_node.evodb->BeginTransaction()};
-        llmq::testutils::WriteMinedCommitment(*m_node.evodb, qc, active[61]->GetBlockHash(),
-                                              /*mined_height=*/61, /*quorum_height=*/60);
+        for (const int base : {10, 20, 30, 40}) {
+            llmq::testutils::WriteMinedCommitment(*m_node.evodb,
+                                                  llmq::testutils::CreateValidCommitment(params, hashes.at(base)),
+                                                  hashes.at(base + 1), /*mined_height=*/base + 1, /*quorum_height=*/base);
+        }
+        // Base 50: an index entry (mined at 51) without its commitment record.
+        m_node.evodb->Write(llmq::testutils::BuildInversedHeightKey(platform_type, 51), 50);
+        // Base 60: a commitment whose public key is invalid.
+        auto bad_key_qc{llmq::testutils::CreateValidCommitment(params, hashes.at(60))};
+        bad_key_qc.quorumPublicKey = CBLSPublicKey{};
+        llmq::testutils::WriteMinedCommitment(*m_node.evodb, bad_key_qc, hashes.at(61), /*mined_height=*/61,
+                                              /*quorum_height=*/60);
+        // Base 70: indexed as mined at 71, but its record names block 90.
+        llmq::testutils::WriteMinedCommitment(*m_node.evodb,
+                                              llmq::testutils::CreateValidCommitment(params, hashes.at(70)),
+                                              hashes.at(90), /*mined_height=*/71, /*quorum_height=*/70);
+        // Base 80: the record stored under its hash is another quorum's commitment.
+        m_node.evodb->Write(std::make_pair(llmq::testutils::DB_MINED_COMMITMENT, std::make_pair(platform_type, hashes.at(80))),
+                            std::make_pair(llmq::testutils::CreateValidCommitment(params, hashes.at(79)), hashes.at(81)));
+        m_node.evodb->Write(llmq::testutils::BuildInversedHeightKey(platform_type, 81), 80);
+        // Base 75: indexed as mined at 76, but its record names a sibling of block 51, which is not on
+        // the active chain.
+        const CBlockIndex* off_chain{AddHeader(*m_node.chainman, *active[50], *active[51])};
+        llmq::testutils::WriteMinedCommitment(*m_node.evodb,
+                                              llmq::testutils::CreateValidCommitment(params, hashes.at(75)),
+                                              off_chain->GetBlockHash(), /*mined_height=*/76, /*quorum_height=*/75);
+        // Base 85: the record stored under its hash is a commitment of another LLMQ type.
+        const auto& other_params{llmq::testutils::GetLLMQParams(Consensus::LLMQType::LLMQ_TEST)};
+        m_node.evodb->Write(std::make_pair(llmq::testutils::DB_MINED_COMMITMENT, std::make_pair(platform_type, hashes.at(85))),
+                            std::make_pair(llmq::testutils::CreateValidCommitment(other_params, hashes.at(85)), hashes.at(86)));
+        m_node.evodb->Write(llmq::testutils::BuildInversedHeightKey(platform_type, 86), 85);
         db_tx->Commit();
     }
-    check_quorums(node->llmq().getPlatformQuorums(std23::to_underlying(llmq_type)), {4, 3, 2});
+    const auto check = [&](std::string_view label, const uint256& hash, uint32_t height,
+                           PlatformQuorumStatus expected) {
+        return CheckPlatformQuorum(llmq, label, type, hash, height, expected);
+    };
+    using enum PlatformQuorumStatus;
+
+    check("healthy neighbour", hashes.at(40), 50, FOUND);
+    check("unknown quorum, healthy window", InsecureRand256(), 44, INVALID);
+    check("record missing", hashes.at(50), 60, UNAVAILABLE);
+    check("invalid key", hashes.at(60), 70, UNAVAILABLE);
+    check("record mined above the height", hashes.at(70), 85, UNAVAILABLE);
+    check("record mined off the active chain", hashes.at(75), 80, UNAVAILABLE);
+    check("record for another quorum", hashes.at(80), 100, UNAVAILABLE);
+    check("record of another type", hashes.at(85), 100, UNAVAILABLE);
+
+    // An entry for base 10 where base 40's belongs, at mined height 41, contradicts base 30's next
+    // entry. Either of the two may be wrong, so base 10 is not taken from it, valid record or not.
+    m_node.evodb->Write(llmq::testutils::BuildInversedHeightKey(platform_type, 41), 10);
+    check("base implicated by a contradiction", hashes.at(10), 44, UNAVAILABLE);
+    m_node.evodb->Write(llmq::testutils::BuildInversedHeightKey(platform_type, 41), 40);
+    check("contradiction removed", hashes.at(10), 44, FOUND);
+
+    // A second index entry for base 30, mined at 43, would take a window slot from base 10 at height 44.
+    // Along one index the quorum bases strictly decrease, so the scan stops at base 40's entry and the
+    // window does not read cleanly.
+    BOOST_REQUIRE(m_node.evodb->GetRawDB().Write(llmq::testutils::BuildInversedHeightKey(platform_type, 43), 30));
+    check("unknown quorum, duplicate index entry", InsecureRand256(), 44, UNAVAILABLE);
+    BOOST_REQUIRE(m_node.evodb->GetRawDB().Erase(llmq::testutils::BuildInversedHeightKey(platform_type, 43)));
+    check("duplicate index entry removed", hashes.at(10), 44, FOUND);
+
+    // An index value that does not deserialize, at mined height 45 inside the type's range.
+    BOOST_REQUIRE(m_node.evodb->GetRawDB().Write(llmq::testutils::BuildInversedHeightKey(platform_type, 45), uint8_t{0}));
+    check("window read below the corrupt entry", hashes.at(40), 44, FOUND);
+    check("window entry unreadable", hashes.at(40), 50, UNAVAILABLE);
+    check("unknown quorum, window unreadable", InsecureRand256(), 50, UNAVAILABLE);
+
+    // Another one at mined height 25: at height 44 the walk reads bases 40 and 30 before it.
+    BOOST_REQUIRE(m_node.evodb->GetRawDB().Write(llmq::testutils::BuildInversedHeightKey(platform_type, 25), uint8_t{0}));
+    check("found ahead of an unreadable entry", hashes.at(40), 44, FOUND);
+    check("behind an unreadable entry", hashes.at(20), 44, UNAVAILABLE);
+}
+
+namespace {
+// Points the node's LLMQ context, and with it the LLMQ interface, at another EvoDB until destroyed.
+class ScopedLLMQContext
+{
+    node::NodeContext& m_node;
+    std::unique_ptr<LLMQContext> m_saved;
+
+public:
+    ScopedLLMQContext(node::NodeContext& node, CEvoDB& evo_db) :
+        m_node{node}
+    {
+        LOCK(::cs_main);
+        auto replacement{std::make_unique<LLMQContext>(*m_node.dmnman, evo_db, *m_node.chainman,
+                                                       util::DbWrapperParams{.memory = true, .wipe = true},
+                                                       /*bls_threads=*/0, /*worker_count=*/1,
+                                                       llmq::DEFAULT_MAX_RECOVERED_SIGS_AGE)};
+        m_saved = std::exchange(m_node.llmq_ctx, std::move(replacement));
+    }
+    ~ScopedLLMQContext() { m_node.llmq_ctx = std::move(m_saved); }
+};
+} // namespace
+
+// A LevelDB read error is a local fault too: a table block that fails its checksum answers
+// UNAVAILABLE, whether it holds window entries or the selected commitment record. Each EvoDB here
+// is on disk, closed, corrupted and reopened. The tip is chain-locked, as above.
+BOOST_AUTO_TEST_CASE(getPlatformQuorum_disk_faults)
+{
+    const auto platform_type{Params().GetConsensus().llmqTypePlatform};
+    const auto& params{llmq::testutils::GetLLMQParams(platform_type)};
+    const uint8_t type{std23::to_underlying(platform_type)};
+    const auto* tip{WITH_LOCK(::cs_main, return m_node.chainman->ActiveChain().Tip())};
+    RecordChainLock(*m_node.chainlocks, tip->nHeight, tip);
+    std::map<int, uint256> hashes;
+    // Bases 20, 30, 40 and 50, each mined one block later. The filler ends the table block holding
+    // the commitment records.
+    const auto write_db = [&](const fs::path& path) {
+        LOCK(::cs_main);
+        const CChain& active{m_node.chainman->ActiveChain()};
+        CEvoDB db{util::DbWrapperParams{.path = path, .memory = false, .wipe = true}};
+        auto& raw{db.GetRawDB()};
+        for (const int base : {20, 30, 40, 50}) {
+            hashes[base] = active[base]->GetBlockHash();
+            BOOST_REQUIRE(raw.Write(std::make_pair(llmq::testutils::DB_MINED_COMMITMENT,
+                                                   std::make_pair(platform_type, hashes[base])),
+                                    std::make_pair(llmq::testutils::CreateValidCommitment(params, hashes[base]),
+                                                   active[base + 1]->GetBlockHash())));
+            BOOST_REQUIRE(raw.Write(llmq::testutils::BuildInversedHeightKey(platform_type, base + 1),
+                                    llmq::testutils::PaddedIndexValue(base)));
+        }
+        BOOST_REQUIRE(raw.Write(std::string{"filler"}, std::vector<uint8_t>(8192, 0)));
+        raw.CompactFull();
+    };
+    using enum PlatformQuorumStatus;
+
+    const fs::path index_path{m_args.GetDataDirNet() / "corrupt_index"};
+    write_db(index_path);
+    BOOST_REQUIRE(llmq::testutils::CorruptTableBlock(index_path / "evodb", std::vector<uint8_t>(64, 40)));
+    {
+        CEvoDB db{util::DbWrapperParams{.path = index_path, .memory = false, .wipe = false}};
+        const ScopedLLMQContext scoped_llmq{m_node, db};
+        auto node{interfaces::MakeNode(m_node)};
+        auto& llmq{node->llmq()};
+        CheckPlatformQuorum(llmq, "read ahead of a corrupt index block", type, hashes.at(50), 100, FOUND);
+        CheckPlatformQuorum(llmq, "in a corrupt index block", type, hashes.at(40), 100, UNAVAILABLE);
+        CheckPlatformQuorum(llmq, "behind a corrupt index block", type, hashes.at(20), 100, UNAVAILABLE);
+        CheckPlatformQuorum(llmq, "window below a corrupt index block", type, hashes.at(30), 35, FOUND);
+        CheckPlatformQuorum(llmq, "unknown quorum, window below a corrupt index block", type, InsecureRand256(), 35,
+                            INVALID);
+    }
+
+    const fs::path record_path{m_args.GetDataDirNet() / "corrupt_record"};
+    write_db(record_path);
+    // Base 50's mined block hash appears only in its commitment record.
+    const uint256 base_50_mined_block{WITH_LOCK(::cs_main, return m_node.chainman->ActiveChain()[51]->GetBlockHash())};
+    BOOST_REQUIRE(
+        llmq::testutils::CorruptTableBlock(record_path / "evodb",
+                                           std::vector<uint8_t>(base_50_mined_block.begin(), base_50_mined_block.end())));
+    {
+        CEvoDB db{util::DbWrapperParams{.path = record_path, .memory = false, .wipe = false}};
+        const ScopedLLMQContext scoped_llmq{m_node, db};
+        auto node{interfaces::MakeNode(m_node)};
+        auto& llmq{node->llmq()};
+        CheckPlatformQuorum(llmq, "commitment record unreadable", type, hashes.at(50), 100, UNAVAILABLE);
+    }
 }
 
 // getInstantSendLock returns the network-serialized islock for a locked txid, and an empty vector
diff --git a/src/test/llmq_blockprocessor_tests.cpp b/src/test/llmq_blockprocessor_tests.cpp
index 46ccfc1f1f16..4ba30396f3e7 100644
--- a/src/test/llmq_blockprocessor_tests.cpp
+++ b/src/test/llmq_blockprocessor_tests.cpp
@@ -6,13 +6,17 @@
 #include <test/util/net.h>
 #include <test/util/setup_common.h>
 
+#include <chain.h>
 #include <chainparams.h>
 #include <consensus/params.h>
+#include <evo/evodb.h>
 #include <hash.h>
 #include <masternode/meta.h>
 #include <net.h>
 #include <net_processing.h>
 #include <streams.h>
+#include <util/fs.h>
+#include <util/std23.h>
 #include <util/time.h>
 #include <validation.h>
 #include <version.h>
@@ -25,6 +29,8 @@
 
 #include <boost/test/unit_test.hpp>
 
+#include <vector>
+
 using namespace llmq;
 using namespace llmq::testutils;
 
@@ -135,4 +141,178 @@ BOOST_FIXTURE_TEST_CASE(unrequested_qfcommit_is_dropped_and_scored, TestChain100
     SetMockTime(0s);
 }
 
+namespace {
+std::vector<int> BaseHeights(const MinedCommitmentScan& scan)
+{
+    std::vector<int> heights;
+    heights.reserve(scan.bases.size());
+    for (const auto* base : scan.bases)
+        heights.push_back(base->nHeight);
+    return heights;
+}
+} // namespace
+
+// A scan of mined commitments may only be read as "nothing older exists" when it filled the requested
+// window or walked off the end of the type's index. Entries are installed directly in EvoDB.
+BOOST_FIXTURE_TEST_CASE(scan_mined_commitments_reports_coverage, TestChain100Setup)
+{
+    const auto& qbp = *m_node.llmq_ctx->quorum_block_processor;
+    constexpr auto type = Consensus::LLMQType::LLMQ_TEST;
+    LOCK(::cs_main);
+    const CChain& active = m_node.chainman->ActiveChain();
+    {
+        auto db_tx = m_node.evodb->BeginTransaction();
+        for (const int base : {10, 20, 30, 40, 50}) {
+            WriteMinedCommitment(*m_node.evodb, CreateValidCommitment(GetLLMQParams(type), active[base]->GetBlockHash()),
+                                 active[base + 1]->GetBlockHash(), /*mined_height=*/base + 1, /*quorum_height=*/base);
+        }
+        db_tx->Commit();
+    }
+    // The key right after this type's range is no index key at all and holds no height. The walk must
+    // end at the prefix without parsing it.
+    const auto next_type = static_cast<Consensus::LLMQType>(std23::to_underlying(type) + 1);
+    BOOST_REQUIRE(
+        m_node.evodb->GetRawDB().Write(std::make_pair(DB_MINED_COMMITMENT_BY_INVERSED_HEIGHT, next_type), uint8_t{0}));
+
+    auto scan = qbp.ScanMinedCommitmentsUntilBlock(type, active.Tip(), 4);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({50, 40, 30, 20}));
+    BOOST_CHECK(scan.complete);
+    BOOST_CHECK(scan.bases == qbp.GetMinedCommitmentsUntilBlock(type, active.Tip(), 4));
+
+    // Young chain: fewer entries than requested, and complete because the walk left the type's range.
+    scan = qbp.ScanMinedCommitmentsUntilBlock(type, active[25], 4);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({20, 10}));
+    BOOST_CHECK(scan.complete);
+
+    // An index value that does not deserialize, at mined height 35.
+    BOOST_REQUIRE(m_node.evodb->GetRawDB().Write(BuildInversedHeightKey(type, 35), uint8_t{0}));
+    scan = qbp.ScanMinedCommitmentsUntilBlock(type, active.Tip(), 4);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({50, 40}));
+    BOOST_CHECK(!scan.complete);
+    // A window filled before the corrupt entry, or a walk starting below it, never reads it.
+    scan = qbp.ScanMinedCommitmentsUntilBlock(type, active.Tip(), 2);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({50, 40}));
+    BOOST_CHECK(scan.complete);
+    scan = qbp.ScanMinedCommitmentsUntilBlock(type, active[34], 4);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({30, 20, 10}));
+    BOOST_CHECK(scan.complete);
+
+    // An entry whose quorum base is not below the block that mined it.
+    BOOST_REQUIRE(m_node.evodb->GetRawDB().Write(BuildInversedHeightKey(type, 15), 15));
+    scan = qbp.ScanMinedCommitmentsUntilBlock(type, active[34], 4);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({30, 20}));
+    BOOST_CHECK(!scan.complete);
+
+    // A commitment is mined within its own quorum's DKG interval, so the quorum bases strictly
+    // decrease along the index. A second entry for base 50, or an entry for an older base above
+    // base 50's, contradicts the next one, and either of the two may be the wrong one.
+    BOOST_REQUIRE(m_node.evodb->GetRawDB().Write(BuildInversedHeightKey(type, 55), 50));
+    scan = qbp.ScanMinedCommitmentsUntilBlock(type, active.Tip(), 2);
+    BOOST_CHECK(BaseHeights(scan).empty());
+    BOOST_CHECK(!scan.complete);
+    BOOST_REQUIRE(m_node.evodb->GetRawDB().Write(BuildInversedHeightKey(type, 55), 45));
+    scan = qbp.ScanMinedCommitmentsUntilBlock(type, active.Tip(), 2);
+    BOOST_CHECK(BaseHeights(scan).empty());
+    BOOST_CHECK(!scan.complete);
+    // An entry before the contradicting pair is kept.
+    BOOST_REQUIRE(m_node.evodb->GetRawDB().Write(BuildInversedHeightKey(type, 58), 52));
+    scan = qbp.ScanMinedCommitmentsUntilBlock(type, active.Tip(), 3);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({52}));
+    BOOST_CHECK(!scan.complete);
+}
+
+// LevelDB steps over a table block that fails its checksum and keeps iterating. The entries after
+// such a block are not the next newest ones, and the window is not complete. The EvoDB here is on
+// disk, closed, corrupted and reopened.
+BOOST_FIXTURE_TEST_CASE(scan_mined_commitments_stops_at_corrupt_block, TestChain100Setup)
+{
+    constexpr auto type = Consensus::LLMQType::LLMQ_TEST;
+    const fs::path path{m_args.GetDataDirNet() / "corrupt_index"};
+    {
+        CEvoDB db{util::DbWrapperParams{.path = path, .memory = false, .wipe = true}};
+        for (const int base : {20, 30, 40, 50}) {
+            BOOST_REQUIRE(db.GetRawDB().Write(BuildInversedHeightKey(type, base + 1), PaddedIndexValue(base)));
+        }
+        db.GetRawDB().CompactFull();
+    }
+    // Each padded entry ends its table block, so base 40's entry has a block of its own.
+    BOOST_REQUIRE(CorruptTableBlock(path / "evodb", std::vector<uint8_t>(64, 40)));
+
+    CEvoDB db{util::DbWrapperParams{.path = path, .memory = false, .wipe = false}};
+    const CQuorumBlockProcessor qbp{*m_node.chainman, *m_node.dmnman, db, *m_node.llmq_ctx->qsnapman,
+                                    /*bls_threads=*/0};
+    LOCK(::cs_main);
+    const CChain& active = m_node.chainman->ActiveChain();
+    auto scan = qbp.ScanMinedCommitmentsUntilBlock(type, active.Tip(), 4);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({50}));
+    BOOST_CHECK(!scan.complete);
+    // A window filled before the corrupt block does not depend on it, and a walk starting below it
+    // never reaches it.
+    scan = qbp.ScanMinedCommitmentsUntilBlock(type, active.Tip(), 1);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({50}));
+    BOOST_CHECK(scan.complete);
+    scan = qbp.ScanMinedCommitmentsUntilBlock(type, active[35], 4);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({30, 20}));
+    BOOST_CHECK(scan.complete);
+}
+
+// Rotation-enabled types are read cycle by cycle, quorum index by quorum index, as
+// GetMinedCommitmentsIndexedUntilBlock does.
+BOOST_FIXTURE_TEST_CASE(scan_mined_commitments_indexed_reports_coverage, TestChain100Setup)
+{
+    const auto& qbp = *m_node.llmq_ctx->quorum_block_processor;
+    constexpr auto type = Consensus::LLMQType::LLMQ_TEST_DIP0024;
+    BOOST_REQUIRE(Params().GetLLMQ(type).has_value());
+    BOOST_REQUIRE_EQUAL(GetLLMQParams(type).signingActiveQuorumCount, 2);
+    LOCK(::cs_main);
+    const CChain& active = m_node.chainman->ActiveChain();
+    {
+        // Cycles at 24, 48 and 72: quorum index i has its base at cycle + i and is mined at cycle + 12 + i.
+        auto db_tx = m_node.evodb->BeginTransaction();
+        for (const int cycle : {24, 48, 72}) {
+            for (const int quorum_index : {0, 1}) {
+                m_node.evodb->Write(BuildInversedHeightKeyIndexed(type, cycle + 12 + quorum_index, quorum_index),
+                                    cycle + quorum_index);
+            }
+        }
+        db_tx->Commit();
+    }
+
+    auto scan = qbp.ScanMinedCommitmentsIndexedUntilBlock(type, active.Tip(), 4);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({72, 73, 48, 49}));
+    BOOST_CHECK(scan.complete);
+    BOOST_CHECK(scan.bases == qbp.GetMinedCommitmentsIndexedUntilBlock(type, active.Tip(), 4));
+
+    scan = qbp.ScanMinedCommitmentsIndexedUntilBlock(type, active.Tip(), 10);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({72, 73, 48, 49, 24, 25}));
+    BOOST_CHECK(scan.complete);
+    scan = qbp.ScanMinedCommitmentsIndexedUntilBlock(type, active[40], 4);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({24, 25}));
+    BOOST_CHECK(scan.complete);
+
+    // Quorum index 0's newest entry names base 40, older than its next entry's base 48. The first
+    // cycle takes base 40; the second meets the contradiction and drops it again.
+    m_node.evodb->Write(BuildInversedHeightKeyIndexed(type, 84, 0), 40);
+    scan = qbp.ScanMinedCommitmentsIndexedUntilBlock(type, active.Tip(), 4);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({73}));
+    BOOST_CHECK(!scan.complete);
+    m_node.evodb->Write(BuildInversedHeightKeyIndexed(type, 84, 0), 72);
+
+    // Quorum index 1 has an unreadable entry at mined height 62, met in the second cycle.
+    BOOST_REQUIRE(m_node.evodb->GetRawDB().Write(BuildInversedHeightKeyIndexed(type, 62, 1), uint8_t{0}));
+    scan = qbp.ScanMinedCommitmentsIndexedUntilBlock(type, active.Tip(), 4);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({72, 73, 48}));
+    BOOST_CHECK(!scan.complete);
+    scan = qbp.ScanMinedCommitmentsIndexedUntilBlock(type, active.Tip(), 2);
+    BOOST_CHECK(BaseHeights(scan) == std::vector<int>({72, 73}));
+    BOOST_CHECK(scan.complete);
+
+    // Quorum indexes never share a base: quorum index 1's newest entry names index 0's base 72, and
+    // neither entry is kept.
+    BOOST_REQUIRE(m_node.evodb->GetRawDB().Write(BuildInversedHeightKeyIndexed(type, 86, 1), 72));
+    scan = qbp.ScanMinedCommitmentsIndexedUntilBlock(type, active.Tip(), 2);
+    BOOST_CHECK(BaseHeights(scan).empty());
+    BOOST_CHECK(!scan.complete);
+}
+
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/llmq_params_tests.cpp b/src/test/llmq_params_tests.cpp
index fda9c6fdf58e..a460f9632911 100644
--- a/src/test/llmq_params_tests.cpp
+++ b/src/test/llmq_params_tests.cpp
@@ -184,6 +184,44 @@ BOOST_AUTO_TEST_CASE(llmq_params_calculations_overflow_test)
     BOOST_CHECK_EQUAL(cycles, 0); // 1000 / max_int = 0
 }
 
+// Platform state older than a quorum's eligible DKG intervals below the ChainLock is stale. For a
+// non-rotating type that is signingActiveQuorumCount + 2 intervals, 26 * 24 = 624 blocks for the
+// mainnet and testnet Platform quorums.
+BOOST_AUTO_TEST_CASE(platform_quorum_min_signed_height_test)
+{
+    const LLMQParams& platform = GetLLMQParams(LLMQType::LLMQ_100_67);
+    BOOST_CHECK_EQUAL(PlatformEligibleQuorumCount(platform), 26);
+    BOOST_CHECK_EQUAL(PlatformQuorumMinSignedHeight(platform, 10000), 10000 - 624);
+    BOOST_CHECK_EQUAL(PlatformQuorumMinSignedHeight(GetLLMQParams(LLMQType::LLMQ_25_67), 10000), 10000 - 624);
+    BOOST_CHECK_EQUAL(PlatformQuorumMinSignedHeight(GetLLMQParams(LLMQType::LLMQ_TEST_PLATFORM), 100), 4);
+
+    // ChainLocks stalled at 1000 while the tip moved on to 2000: state signed at 990 is still
+    // accepted. A bound taken from the tip would reject it.
+    constexpr int cl_height{1000};
+    constexpr int tip_height{2000};
+    constexpr int signed_height{990};
+    BOOST_CHECK_GE(signed_height, PlatformQuorumMinSignedHeight(platform, cl_height));
+    BOOST_CHECK_LT(signed_height, PlatformQuorumMinSignedHeight(platform, tip_height));
+
+    // A ChainLock below the window accepts every height.
+    BOOST_CHECK_EQUAL(PlatformQuorumMinSignedHeight(platform, 0), 0);
+    BOOST_CHECK_EQUAL(PlatformQuorumMinSignedHeight(platform, 624), 0);
+    BOOST_CHECK_EQUAL(PlatformQuorumMinSignedHeight(platform, 625), 1);
+
+    BOOST_CHECK_EQUAL(PlatformQuorumMinSignedHeight(platform, std::numeric_limits<int>::max()),
+                      std::numeric_limits<int>::max() - 624);
+
+    // A rotating quorum is signing-active for one DKG interval, and each interval mines one quorum per
+    // quorum index, so the slack adds two intervals' worth of every index: 3 * 32 = 96 quorums of
+    // llmq_60_75 (selectable for Platform on devnets) over 3 * 288 = 864 blocks.
+    const LLMQParams& rotating = GetLLMQParams(LLMQType::LLMQ_60_75);
+    BOOST_REQUIRE(rotating.useRotation);
+    BOOST_CHECK_EQUAL(PlatformEligibleQuorumCount(rotating), 96);
+    BOOST_CHECK_EQUAL(PlatformQuorumMinSignedHeight(rotating, 10000), 10000 - 864);
+    BOOST_CHECK_EQUAL(PlatformEligibleQuorumCount(GetLLMQParams(LLMQType::LLMQ_TEST_DIP0024)), 6);
+    BOOST_CHECK_EQUAL(PlatformQuorumMinSignedHeight(GetLLMQParams(LLMQType::LLMQ_TEST_DIP0024), 100), 28);
+}
+
 //! Build chain params for `chain` with a single LLMQ size/threshold override applied.
 static std::unique_ptr<const CChainParams> ChainParamsWithLLMQOverride(const ChainType chain,
                                                                        const std::string& arg,
diff --git a/src/test/util/llmq_tests.h b/src/test/util/llmq_tests.h
index c8e3718c8861..fe3d328122d8 100644
--- a/src/test/util/llmq_tests.h
+++ b/src/test/util/llmq_tests.h
@@ -23,6 +23,11 @@
 #include <llmq/commitment.h>
 #include <llmq/params.h>
 
+#include <util/fs.h>
+
+#include <algorithm>
+#include <fstream>
+#include <iterator>
 #include <limits>
 #include <string>
 #include <tuple>
@@ -119,6 +124,7 @@ inline uint256 GetTestBlockHash(uint32_t n) { return ArithToUint256(arith_uint25
 // mined-commitment state without a full DKG/mining path.
 inline const std::string DB_MINED_COMMITMENT = "q_mc";
 inline const std::string DB_MINED_COMMITMENT_BY_INVERSED_HEIGHT = "q_mcih";
+inline const std::string DB_MINED_COMMITMENT_BY_INVERSED_HEIGHT_Q_INDEXED = "q_mcihi";
 
 inline std::tuple<std::string, Consensus::LLMQType, uint32_t> BuildInversedHeightKey(Consensus::LLMQType llmqType,
                                                                                     int nMinedHeight)
@@ -127,6 +133,45 @@ inline std::tuple<std::string, Consensus::LLMQType, uint32_t> BuildInversedHeigh
                            htobe32_internal(std::numeric_limits<uint32_t>::max() - nMinedHeight));
 }
 
+inline std::tuple<std::string, Consensus::LLMQType, int, uint32_t> BuildInversedHeightKeyIndexed(Consensus::LLMQType llmqType,
+                                                                                                 int nMinedHeight,
+                                                                                                 int quorumIndex)
+{
+    return std::make_tuple(DB_MINED_COMMITMENT_BY_INVERSED_HEIGHT_Q_INDEXED, llmqType, quorumIndex,
+                           htobe32_internal(std::numeric_limits<uint32_t>::max() - nMinedHeight));
+}
+
+// An inversed-height index value padded past LevelDB's 4 KiB table block size, so that the entry
+// ends the table block it is written to. The padding repeats the quorum height's low byte for
+// CorruptTableBlock to find; readers deserialize only the leading quorum height.
+inline std::pair<int, std::vector<uint8_t>> PaddedIndexValue(int quorum_height)
+{
+    return {quorum_height, std::vector<uint8_t>(8192, static_cast<uint8_t>(quorum_height))};
+}
+
+// Flips a byte of the first occurrence of `needle` in a table file of the closed LevelDB at
+// `db_dir`, so that the table block holding it fails its checksum.
+inline bool CorruptTableBlock(const fs::path& db_dir, const std::vector<uint8_t>& needle)
+{
+    for (const auto& entry : fs::directory_iterator(db_dir)) {
+        if (entry.path().extension() != ".ldb") continue;
+        std::vector<char> bytes;
+        {
+            std::ifstream in{entry.path(), std::ios::binary};
+            bytes.assign(std::istreambuf_iterator<char>(in), std::istreambuf_iterator<char>());
+        }
+        const auto pos{std::search(bytes.begin(), bytes.end(), needle.begin(), needle.end(),
+                                   [](char a, uint8_t b) { return static_cast<uint8_t>(a) == b; })};
+        if (pos == bytes.end()) continue;
+        *pos ^= 1;
+        std::ofstream out{entry.path(), std::ios::binary | std::ios::trunc};
+        out.write(bytes.data(), bytes.size());
+        out.close();
+        return !out.fail();
+    }
+    return false;
+}
+
 // Store a mined commitment as if it was mined at `mined_height` for the quorum whose base block
 // is the active-chain ancestor at `quorum_height`. GetMinedCommitmentsUntilBlock iterates
 // inverted-height keys in [pindex->nHeight, 0), so scan height must be >= mined_height and