The free scan now carries the confidence label, not just the colour

Measured 2026-08-16: a 42-byte contract that merely STORES the constant 0x0AE1 and
never calls anything still scores GREEN, with the reference marked medium
confidence. So the headline colour does not separate a resolved call from a bare
constant, and a client who tests that in five minutes would find it before we
admitted it.

The scan text now says, per address, whether a CALL to each verifier resolved from
the bytecode or whether only the address is present, and says plainly that a
present address can also be plain data. The colour stays what the scanner
computes; the sentence next to it carries what it means.

raport.js

@@ -93,6 +93,9 @@ not-measured lines say why.
 
     ${comanda}
 
+The toolkit is public and installs nothing:
+https://git.aere.network/aere-network/pqc-migration-toolkit
+
 Point \`--rpc\` at a node you run yourself. Nothing here depends on trusting the party that wrote
 this report, and that is the point: an exposure report you cannot re-run is an opinion with a
 logo on it.

scan-gratuit.mjs

@@ -39,7 +39,15 @@ else {
   // migrarea, sa primeasca "nu am putut masura adresa".
   const stare = citesteVerdict(text);
   const cod = (text.match(/code:\s*(\d+)\s*bytes/) || [])[1] || null;
-  const verif = [...text.matchAll(/^\s*-\s*(0x[0-9a-f]+)\s+(.+?)\s*(\[[a-z]+\])?$/gim)].map((m) => m[2].trim());
+  // Eticheta de incredere e informatia care conteaza, mai mult decat culoarea verdictului: o
+  // referinta "call-proximate" inseamna ca apelul s-a rezolvat din bytecode, una "medium" inseamna
+  // ca doar constanta e prezenta si putea ajunge acolo si ca simpla data. Masurat 2026-08-16: un
+  // contract de 42 de octeti care doar STOCHEAZA constanta iese tot GREEN. Deci culoarea singura nu
+  // separa cele doua cazuri, si textul catre client trebuie sa poarte eticheta.
+  const refer = [...text.matchAll(/^\s*-\s*(0x[0-9a-f]+)\s+(.+?)\s*\[([a-z]+)(, call-proximate)?\]\s*$/gim)]
+    .map((m) => ({ nume: m[2].trim(), incredere: m[3], apel: !!m[4] }));
+  const verif = refer.map((r) => r.nume);
+  const cuApel = refer.filter((r) => r.apel).length;
   const deschise = [...text.matchAll(/^\s*\*\s*(\[(?:VERIFY|MEASURE)\][^\n]*)/gim)].map((m) => m[1].trim());
 
   // The one sentence that has to be true and has to be useful.
@@ -52,12 +60,11 @@ else {
     // it says so in its own [VERIFY] note. Claiming "can reach" in the sales hook when the tool
     // itself refused to settle it would be selling a maybe as a yes, in the first sentence a
     // prospect reads. So the wording follows the measurement, and the caveat travels with it.
-    const nesigur = deschise.some((d) => /no CALL to it was resolved|may be staged/i.test(d));
     verdict = 'The bytecode of this contract references ' + verif.length + ' live post-quantum verifier'
       + (verif.length === 1 ? '' : 's') + ' (' + verif.slice(0, 3).join(', ') + (verif.length > 3 ? ', and more' : '') + '). '
-      + (nesigur
+      + (cuApel > 0
-        ? 'We could NOT confirm from bytecode alone that it calls them: the addresses are pushed, but the call target may be assembled at runtime. So this is a promising sign, not a proven capability, and settling it needs the source or a call trace.'
+        ? 'For ' + cuApel + ' of them the CALL resolved from the bytecode, so the verification half of a migration is genuinely reachable in this contract.'
-        : 'The calls to them resolved from the bytecode, so the verification half of a migration is already reachable in this contract.');
+        : 'For NONE of them could we resolve a CALL from the bytecode: the addresses are present, but a present address can also be plain data. So this is a lead, not a proven capability, and settling it needs the source or a call trace. We are telling you this because the headline verdict alone does not separate the two cases.');
   }
   else verdict = 'This contract reaches no post-quantum verifier. Everything it authorises today rests on ECDSA secp256k1, which is exactly the primitive the published migration timelines are about. That is the normal situation in 2026, not a criticism.';
 
@@ -79,7 +86,8 @@ else {
     linii.push('');
   }
   linii.push('CHECK US, DO NOT TRUST US');
-  linii.push('  git clone the toolkit and run the same thing against a node you operate:');
+  linii.push('  git clone https://git.aere.network/aere-network/pqc-migration-toolkit');
+  linii.push('  then run the same measurement against a node you operate:');
   linii.push('    node scan.js ' + ADRESA + ' --rpc https://your-own-node');
   linii.push('  If your number differs from ours, that difference is the interesting part and we');
   linii.push('  want to hear about it.');