The configured Coinbase SDK is shipped in dist/assets/dist-rG0n5I1c.js (line 1). With no injected Coinbase wallet, selecting this connector opens https://keys.coinbase.com/connect. The resulting wallet window loads JavaScript from keys.coinbase.com and fp.coinbase.com and sends requests to as.coinbase.com/amp.

These destinations are neither public Ethereum RPCs, api.imd.fun, nor IPFS gateways, so the pinned export does not satisfy the stated external-request restriction for its connection flow. The scripts run in the Coinbase popup, not the Sworn document; this is a disclosed wallet choice rather than evidence of a drainer or a hosting-blocking malicious payload.

This global rule is present in the hosted dist/assets/index-jlO75_Ep.css (line 1) and removes the resting underline from prose links rendered by dist/assets/index-CK9qS_xu.js. On the home page, the IMD agents link has only 1.01:1 contrast against its surrounding text; four links in How it works have 2.23:1. They have no other resting visual distinction.

Visitors who cannot distinguish these colors can miss the links. Hover-only underlining does not solve discovery on touch devices. This is an accessibility advisory, not a reason to block hosting.

The hosted dist/assets/FactCheckLive-BCIE2MnG.js accepts a non-address wallet query and invokes getEnsAddress, but its runtime client, constructed in dist/assets/index-CK9qS_xu.js, defines only multicall3 in chain.contracts. The bundled viem resolver requires ensUniversalResolver and throws before sending an ENS resolution call. Consequently every ENS wallet link falls into the generic unresolved-name message even when mainnet reads are healthy.

This is a functional advisory, not unsafe content.

The Curator consumer in dist/assets/index-CK9qS_xu.js clears its previous result, then returns immediately for an empty address. The form has neither a required attribute nor an empty-input error. Pressing its enabled Check eligibility button therefore appears to do nothing, leaving visitors without a correction or explanation.

This is a usability advisory.

Now: Fact History renders the raw RPC exception, including "Payment blocked" and "Version: viem@2.57.7", even for a disconnected visitor making only a public read. This is inherited unchanged from the requested commit.

Change to: In a future upstream release, map this history-read failure to "Fact history is unavailable because Ethereum providers could not agree. Try again." and retain the existing "Retry history" button; keep this task's pinned dist/ unchanged.

Why: The message should explain the failed read without implying that the visitor attempted a payment. This is informational because the current brief explicitly requires the supplied export to be used unchanged.

Now: Whenever health is null, all three paid-fact sections of Catalog say "Cost: oracle price per request, simulated here" beside the Mint Facts link, although this export is the live Ethereum client. The condition also occurs during normal initial loading. This wording is inherited from the pinned release.

Change to: In a future upstream release, replace that fallback with "Live oracle quote unavailable. Request fees are paid in IMD." while keeping the existing Mint Facts link and fee disclosures. Preserve the current pinned dist/ for this assignment.

Why: An unavailable quote does not put the app into simulation mode. The copy should report only the unavailable read, particularly beside an action that can spend real funds. This is an informational upstream note because the brief requires an unchanged export.