@@ -8,6 +8,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Added
 
+- Restore externally persisted spent-output claims with `ManagedWalletInfo::restore_spent_outpoints` in `key-wallet`.
+  Claims are held once per wallet and guard every account that holds funds, including one added later.
+  It returns the restored outpoints the wallet still holds as UTXOs, which stay credited.
 - Make `PublicKey::with_serialized` public
 - `EcdsaPublicKey`, `EcdsaSecretKey`, `EcdsaSignature`, `EcdsaRecSignature`,
   `EcdsaError` and the `ECDSA_*_LEN` constants in `dashcore::ecdsa`
@@ -90,6 +93,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - Relicense `dash-network`, `dash-network-seeds`, `dash-spv`, `dash-spv-ffi`,
   `dash-spv-bench`, `git-state` and `masternode-seeds-fetcher` to CC0-1.0
 - All workspace crates declare a MSRV of 1.89
+- `ManagedWalletInfo::sweep_conflicts` and `abandon_transaction_with_spends` in `key-wallet` release
+  a restored spent-output claim that names a transaction they remove. `released_outpoints` of a
+  sweep, as `WalletEvent::TransactionsSwept` and the `dash-spv-ffi` swept callback carry it, lists
+  an outpoint only once no claim and no account's own spent mark guards it.
 - Human-readable serde of `PublicKey`, `ShortId` and `PlatformNodeId` also
   accepts raw bytes, and their deserialization errors read differently
 - `RootExtendedPubKey` now supports hybrid SEC1 public keys in human-readable
 
@@ -797,8 +797,11 @@ impl FFIOutPoint {
 /// `txids` points to `txids_count` consecutive 32-byte txids.
 /// `superseded_by` is the transaction whose arrival settled the inputs.
 /// `released_outpoints` points to `released_outpoints_count` outpoints freed
-/// by the removal: inputs the removed transactions claimed to spend that no
-/// surviving record spends too. Mark these coins spendable again. This is
+/// by the removal, as `WalletEvent::TransactionsSwept::released_outpoints`
+/// documents: inputs of the removed transactions that no surviving record
+/// spends too, and outpoints whose spent-output claim named a removed
+/// transaction, each listed only once nothing in the wallet guards it any
+/// more. Mark these coins spendable again. This is
 /// not the same set as `txids`' inputs — a loser spending A+B against a
 /// winner spending only A leaves A marked and frees only B — and it cannot
 /// be recomputed from `txids` on the consumer side: `superseded_by` need not
 
@@ -273,17 +273,21 @@ pub enum WalletEvent {
         /// possibly-invisible transaction also claims — so guessing either
         /// re-credits a coin the chain has already spent or leaves a
         /// genuinely free one stranded as spent forever. Wallet-scoped
-        /// rather than attributed per removed transaction: a consumer holds
-        /// every input of every transaction it deletes here, so it only
-        /// needs to know which of them came free, not which removal freed
+        /// rather than attributed per removed transaction: a consumer only
+        /// needs to know which coins came free, not which removal freed
         /// which.
         ///
+        /// An outpoint whose spent-output claim named a removed transaction
+        /// is released too, and either kind is listed only once nothing in
+        /// the wallet guards it any more — see
+        /// `WalletConflictSweep::released_outpoints` in key-wallet.
+        ///
         /// One pre-existing limitation, inherited from `release_spent_marks`
         /// rather than introduced with this field: it decides what stays
         /// spent from the wallet's *live* records, and under the default
         /// `keep-finalized-transactions = off` a chainlocked record is pruned
-        /// to just its txid. So if this wallet ever recorded a second spend
-        /// of a coin an already-pruned chainlocked transaction took — which
+        /// to just its txid. So if an account ever recorded a second spend
+        /// of a coin its own already-pruned chainlocked transaction took — which
         /// needs that second spend to arrive after the pruning, since
         /// otherwise the chainlocked arrival would have swept it — and that
         /// second spend is later swept on a different input, the coin is
 
@@ -64,7 +64,8 @@ ManagedCoreFundsAccount (Mutable)
 ├── balance: WalletCoreBalance
 ├── transactions: BTreeMap<Txid, TransactionRecord>
 ├── utxos: BTreeMap<OutPoint, Utxo>
-└── spent_outpoints: HashSet<OutPoint>  // private, rebuilt on deserialization
+├── spent_outpoints: HashSet<OutPoint>  // private, rebuilt on deserialization
+└── claim_guarded_outputs: BTreeMap<OutPoint, Utxo>  // not serialized; outputs a wallet-level claim (ManagedWalletInfo::spent_claims, see restore_spent_outpoints) keeps out of utxos, for input matching
 ```
 
 ### Address Pool Architecture
 
@@ -309,6 +309,10 @@ impl<'a> ManagedAccountRefMut<'a> {
     /// without wallet-level block processing. The wallet checker uses
     /// `Self::record_transaction_with_observed_spends` instead, which
     /// reconciles the record against the wallet-level observed-spent set.
+    ///
+    /// Spent-output claims are wallet-level state too, so this entry point
+    /// does not see them: an output restored as spent with
+    /// `ManagedWalletInfo::restore_spent_outpoints` is credited here.
     pub fn record_transaction(
         &mut self,
         tx: &Transaction,
@@ -322,6 +326,7 @@ impl<'a> ManagedAccountRefMut<'a> {
             context,
             transaction_type,
             &BTreeMap::new(),
+            &BTreeMap::new(),
             &BTreeSet::new(),
         )
     }
@@ -331,15 +336,20 @@ impl<'a> ManagedAccountRefMut<'a> {
     /// (dashpay/rust-dashcore#649); only the funds variant consults it (keys
     /// accounts track no UTXOs/output details).
     ///
+    /// `spent_claims` is the wallet-level `ManagedWalletInfo::spent_claims`
+    /// view; an output it names is not credited.
+    ///
     /// `external_final_parents` is the wallet-level view of input parents held
     /// by sibling accounts, used for the trusted-self-send determination.
+    #[expect(clippy::too_many_arguments, reason = "one argument per wallet-level view")]
     pub(crate) fn record_transaction_with_observed_spends(
         &mut self,
         tx: &Transaction,
         account_match: &AccountMatch,
         context: TransactionContext,
         transaction_type: TransactionType,
         observed_spent: &BTreeMap<OutPoint, CoreBlockHeight>,
+        spent_claims: &BTreeMap<OutPoint, Option<Txid>>,
         external_final_parents: &BTreeSet<OutPoint>,
     ) -> TransactionRecord {
         match self {
@@ -349,6 +359,7 @@ impl<'a> ManagedAccountRefMut<'a> {
                 context,
                 transaction_type,
                 observed_spent,
+                spent_claims,
                 external_final_parents,
             ),
             ManagedAccountRefMut::Keys(a) => {
@@ -366,6 +377,10 @@ impl<'a> ManagedAccountRefMut<'a> {
     /// pre-#649 behavior, appropriate for callers driving an account directly
     /// without wallet-level block processing. The wallet checker uses
     /// `Self::confirm_transaction_with_observed_spends` instead.
+    ///
+    /// Spent-output claims are wallet-level state too, so this entry point
+    /// does not see them: an output restored as spent with
+    /// `ManagedWalletInfo::restore_spent_outpoints` is credited here.
     pub fn confirm_transaction(
         &mut self,
         tx: &Transaction,
@@ -379,6 +394,7 @@ impl<'a> ManagedAccountRefMut<'a> {
             context,
             transaction_type,
             &BTreeMap::new(),
+            &BTreeMap::new(),
             &BTreeSet::new(),
         )
     }
@@ -387,15 +403,20 @@ impl<'a> ManagedAccountRefMut<'a> {
     /// against `observed_spent` — the wallet-level `observed_spent_outpoints`
     /// view (dashpay/rust-dashcore#649); only the funds variant consults it.
     ///
+    /// `spent_claims` is the wallet-level `ManagedWalletInfo::spent_claims`
+    /// view; an output it names is not credited.
+    ///
     /// `external_final_parents` is the wallet-level view of input parents held
     /// by sibling accounts, used for the trusted-self-send determination.
+    #[expect(clippy::too_many_arguments, reason = "one argument per wallet-level view")]
     pub(crate) fn confirm_transaction_with_observed_spends(
         &mut self,
         tx: &Transaction,
         account_match: &AccountMatch,
         context: TransactionContext,
         transaction_type: TransactionType,
         observed_spent: &BTreeMap<OutPoint, CoreBlockHeight>,
+        spent_claims: &BTreeMap<OutPoint, Option<Txid>>,
         external_final_parents: &BTreeSet<OutPoint>,
     ) -> Option<TransactionRecord> {
         match self {
@@ -405,6 +426,7 @@ impl<'a> ManagedAccountRefMut<'a> {
                 context,
                 transaction_type,
                 observed_spent,
+                spent_claims,
                 external_final_parents,
             ),
             ManagedAccountRefMut::Keys(a) => {