CI caught it: the fixture README added in bc0fb2a wrote the TestNet app id
literally, which is one more mention test_app_id_references_are_coherent.py
must classify. The README now points to DEFAULT_APP_ID instead, so no new
classification is needed. Local: that test 31 passed; the SDK wire-format
suite (pytest tests, dev extra, no native lib) 130 passed, 21 skipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The new Rust port's recorded response (application_recorded.json) mentions
TestNet app 770964251, and test_app_id_references_are_coherent.py fails on
any mention it cannot classify (verified: 1 failed before, 31 passed after,
pytest 9 in a scratch venv). It is a record of what the chain served on
2026-11-05, so it joins FROZEN with a comment saying why. This is a data
entry in an existing Python test's classification set, required by that
test's own instruction ("Decide which it is"); no Python logic changed.

tests/fixtures/README.md states how the responses were recorded (read-only)
and that params.global-state was removed from the application response
(gitleaks false positive on base64 state-variable names); the fields the
verifier reads are as served.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

rust/crates/teal-deploy-verify (binary: verify-deployment) is a READ-ONLY Rust port of
contracts/verify_deployment.py, written with the Python as its oracle: same default target
(the TestNet app, algonode), same exit codes (0 MATCH, 1 DRIFT, 2 COULD NOT CHECK). It
assembles BOTH committed TEAL files with algod POST /v2/teal/compile, fetches both deployed
programs with one GET /v2/applications/{id}, reads the network genesis from GET /versions
(display only), and prints length + SHA-512/256 of expected and actual for each program.
The verdict compares bytes; the hashes are for display.

Tightenings over the Python, each printed or documented:
- the clear-state program is compared too; a DRIFT in either program is a DRIFT;
- the application response's id must be the one asked for; base64 must be canonical; an
  empty program is not a program; a non-2xx status (redirects included) is never parsed;
- network-supplied text is sanitised before it reaches the terminal;
- a panic is mapped to exit 2 by a panic hook (never 1 or 101; not exercised by a test).

HTTPS goes through the system curl executable (argv only, -q first so no .curlrc,
--proto =https, no redirects, no --insecure), so the crate's dependency graph stays pure
Rust: no ring, aws-lc-*, openssl-sys or cc. One new workspace dependency, base64 0.22,
justified in rust/Cargo.toml (whose sha2 and serde_json comments are corrected too).

Tests: 65 new (21 unit; 28 offline on a frozen recording of the 2026-11-05 TestNet
responses; 11 loopback through the real system curl and the real binary; 5 oracle-coherence
checks against contracts/verify_deployment.py) plus 1 ignored live TestNet test, run once
here and green. Mutation-checked: dropping the clear-state comparison, reading an
unobtainable side as MATCH, or comparing the assembled bytes with themselves each turns
named tests red.

CI: rust-ci asserts the key tests ran, by name; testnet-followup gains a non-gating
contract-drift-rust job beside the Python contract-drift job, not instead of it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(accounts): Update placeholder sections for HD accounts and Vault wallet