You have three options to retrieve bytecode: type(C).runtimeCode which returns the runtime code of a contract, type(C).creationCode which returns the creation code of a contract and address.code which returns the code at a certain address (EOA or Smart Contract), which can be empty for an EOA. Now my question is if it is the runtimeCode or the creationCode at the address when calling address.code. This seems to not be documented properly so I wanted to ask the community (https://docs.soliditylang.org/en/latest/units-and-global-variables.html?highlight=address%20initial#members-of-address-types).
A little question to discuss: Is it proper to validate a Smart Contract based on its bytecode (be it the creation or the runtime code) or is this a don't.