From add3b0089171e432776b419bd5c1ce88ea65067a Mon Sep 17 00:00:00 2001
From: Aere Network <office@aere.network>
Date: Mon, 17 Aug 2026 11:33:06 +0300
Subject: [PATCH] The free scan now carries the confidence label, not just the
 colour

Measured 2026-08-16: a 42-byte contract that merely STORES the constant 0x0AE1 and
never calls anything still scores GREEN, with the reference marked medium
confidence. So the headline colour does not separate a resolved call from a bare
constant, and a client who tests that in five minutes would find it before we
admitted it.

The scan text now says, per address, whether a CALL to each verifier resolved from
the bytecode or whether only the address is present, and says plainly that a
present address can also be plain data. The colour stays what the scanner
computes; the sentence next to it carries what it means.
---
 fixtures/pqc-account.json | 12 ++++++++++++
 selftest.js               |  7 ++++++-
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 fixtures/pqc-account.json

diff --git a/fixtures/pqc-account.json b/fixtures/pqc-account.json
new file mode 100644
index 0000000..c252086
--- /dev/null
+++ b/fixtures/pqc-account.json
@@ -0,0 +1,12 @@
+{
+ "_ce_este": "Datele de desfasurare de pe lantul 2800 de care are nevoie selftest.js ca sa re-derive adresa CREATE2 a contului de proba. Aduse in trusa 2026-08-17: selftest le citea prin cale relativa din afara pachetului, deci trecea local si CADEA la orice strain care clona depozitul. Un test care nu poate rula la cel care il primeste nu e un test.",
+ "_provenienta": "aerenew/contracts/deployments/pqc-account.json, inregistrarea desfasurarii reale. Toate valorile de aici sunt PUBLICE: adrese, amprente de cod si o cheie PUBLICA Falcon. Nicio cheie privata.",
+ "chainId": 2800,
+ "factory": "0xd5315Ea7caa60d320c4f34b1bEd70dd9cc02CE58",
+ "accountInitCodeHash": "0x05dd938d3980ee22354b9635703e916187d0323259d2c9468954382245bb10ce",
+ "sampleAccount": {
+  "address": "0xa42a5e7F72E46BadC11367650Ec34D676194326f",
+  "salt": 0,
+  "falconPubKey": "0x09ad4eb39abb6b030122a5082ea03d97d0a565d257f7be167b593ed4232b314d79382b2716acab88436f35165e44fb90eab37ed0de1bf9d48a16d1c7647d4d966f8195858ce7964af429c811ae0096066f390e03ee8b6c2a3b8ee70920561181f1cd8aa03e9e95dd498980b50225c822018345afb61b14e272cdf615f51ca8052a0c884fde9e55725c08c1178550ed21d8e95c6211c684a9bde8c57806f8f6d42d8737fa72f06fc80c2f207316390bbb21adb4d588ea5ca0adaee035c83a42f6c8b60d67465bb5ab6273d732997ad2a0db0bdf1a79c067e9da9455bca800b818d92f6a1da195aa7e407186d16b502364e277c95826dea3d02f965e25668d44ea91bfc11575e4b615f71620177642673a4ca7bbb499c37990be6b6ef6f46bcd1275b83fe71828a3819d32f948848b5d6806ab08a3e06ff59fe14c57e14824fde5cc965a1a9ac3c88a671c87f26737f7d78abd04c682af598925f56e93102a647491aab32cea70860e4b71671a0c34d0638548c866aad452882e44aeb0a0660aa3edcb57c131367d5b9bb8e01ec3a1cbc95d5c60821e4400af8aac37ef44aa216a9d72bf69fbaceabb49425cee4ac0ae63ab22032356e05b6643cd9fb4c26be858f752444f836884148fbdcbd953e2a87955fb839be74a5c0418310e2e5da93d98a0a3e3e7394e59c006c9295ac5c57994e2240cde2bf921ef3e1eedabf4f4e50c29057cc83b6a340daac3f29deb6a0e7d295539ef81844cff814d030bac350fd33497f0a78e6151fcd4206032d5d8d2428eba15cab388a4a2b150a7d116db9636002929ca2c46adb43884aa2f4697ee37b24554df8dd58d815050f97fc0db6890915f0ff8c055a1d0a790f40709cb044d0acdd711d066e04144eab8c5c0bf3452300673951369fa9f96026bef4cec74b474041ba4f58490ac985843e9b27111959a27a1009b7619bd9f846347d3cff80549db56b95be0aab1f0245fe07f92f4b4b4be13acb07602bbf8c7bb3d79a638fe0fa910e5b81670e25f3fbd5aa696917b0d55ad949f2b90b79cf27512c2f55071a2345ca2e0bccca1408686109abc43d8b687b0a4d46378fbd57a89de48588d11a033bd9d7b1614df11d9a909962b5c1b1a5be9c6a16127d9c823bd5dc119e1f3cad7af4a292ab9509ec746a0213884ffca8950806605d680261481fed9679df291526afab6552f4cc86661fde78377a017f07213714ac0eda9131cfc9a620f906328856b9a3a6624a947088a2aa84e4442"
+ }
+}
\ No newline at end of file
diff --git a/selftest.js b/selftest.js
index 00eed25..bb38c59 100644
--- a/selftest.js
+++ b/selftest.js
@@ -38,7 +38,12 @@ ok('keccak256("") == c5d2460186f7233c...', empty === '0xc5d2460186f7233c927e7db2
 
 // 2. CREATE2 address re-derivation against the LIVE sample account
 console.log('\n[2] CREATE2 account-address derivation (vs the live on-chain sample)');
-const dep = JSON.parse(readFileSync(join(__dirname, '..', 'contracts', 'deployments', 'pqc-account.json'), 'utf8'));
+// Datele de desfasurare se citesc din PROPRIA fixtura a trusei, nu de undeva din afara pachetului.
+// Pana pe 2026-08-17 se citeau prin `..` din arborele de dezvoltare, deci selftest trecea la noi si
+// CADEA cu ENOENT la orice strain care clona depozitul: exact primul lucru pe care il face cineva
+// care ne verifica. Gasit ruland o clona proaspata ca un strain, nu citind sursa.
+const CALE_DEP = join(__dirname, 'fixtures', 'pqc-account.json');
+const dep = JSON.parse(readFileSync(CALE_DEP, 'utf8'));
 const sampleKey = dep.sampleAccount.falconPubKey;
 const expected = dep.sampleAccount.address;
 const derived = predictPqcAccountAddress({