Replaced web/ and dist/ with the exact pinned 1.0.1 release. All 423 files verified; no build run.

Typecheck and 291 unit tests passed. README, DESIGN.md and validation evidence are updated, including browser/RPC limitations. Submission is under 8 MiB and ready for the existing sworn publisher.

The review is complete and the site is clear to host. Nothing critical or high was found. The findings file holds three advisory items only.

What was verified

• Tree matches upstream. The repository's web/ and dist/ are file-for-file identical to commit 5e0dce32 of github.com/banse/sworn, branch sworn-web-1.0.1. dist/ holds exactly the 90 upstream paths, and no earlier-version file remains.
• dist/ is that tree's own build. Running npm ci and npm run build on a scratch copy of the upstream web/ produced output byte-identical to the committed dist/. Every sha256 in dist/imd-deployment.json matches the file it names.
• Addresses are right. The bundle and manifest carry only the launch 2404 contracts, Registry 0x0da2679000ea5380d1361cc3cca7d4e8c881f766. None of this project's launch 2147 addresses appear anywhere in dist/ or web/.
• Browser run. Served dist/ to headless Chromium at 1280 and 390 px across the landing, Catalog, Fact Check, Mint Card, Mint Rule, About and docs pages. The Sworn site renders at both widths. Zero console errors and zero page errors. No favicon error either, since favicon.svg is present.
• Outside requests. At runtime the page contacted only ethereum-rpc.publicnode.com and sworn.vibingco.de. No script was loaded from another origin and no frame was attached. In source, the read RPC list adds gateway.tenderly.co, rpc.mevblocker.io and 1.rpc.thirdweb.com, all public Ethereum RPCs. api.imd.fun is used for oracle request and intake lookups, ipfs.io for ipfs:// images. The Coinbase Wallet connector opens keys.coinbase.com only when a visitor chooses that wallet.
• Scripts read. All nine bundles plus docs/app.js and docs/search-data.js. No eval, Function constructor, document.write, iframe, obfuscation, or seed-phrase and private-key prompts. The script-element creation and "private key" strings are React DOM internals and the noble-curves library. Transactions go through the visitor's own wallet. The only approvals are IMD approvals of the exact quoted amount to the Registry, labelled as such, preceded by a balance and allowance check and re-checked before signing.

Advisory findings written to .imd-findings.json

• Low: og:image in dist/index.html is a relative path, so link previews will not show share.png.
• Info: the handbook in dist/docs links to a localhost mock at port 8799 that no visitor can reach.
• Info: the Fact Check card image resolver passes any https URL and maps ar:// to arweave.net. Unreachable today because the live Renderer returns an inline data URI, confirmed by the browser run.

All three live in the unchanged upstream build, so any fix belongs in banse/sworn rather than here. No repository file was modified apart from the findings file, which git ignores.

Recorded one finding in .imd-findings.json. Site files remain unchanged.

Medium — bug: Explorer hides the initial chain-read error and Retry reads control. At pages.tsx:417, the loading effect reads site.error without depending on it. At 390×844, opening a wallet deep link while external requests return HTTP 503 leaves the explorer status empty and renders zero retry buttons. The footer reports failure at viewport y≈5,642. Resubmitting the address exposes both.

Add site.error to that dependency list in a future authorized upstream release, so failure and recovery appear beside the lookup. The current exact-copy requirement prevents applying that fix here.

Sworn’s visual idea is a public wallet registry presented as a dark monospace instrument panel with green hive artwork. The two taste flags—uppercase headings and monospace prose—remain preservation exceptions under “used unchanged.” Wallet signatures and transactions were not exercised.