One herd.
Clearer choices.

01 · The product boundary

Strategy first.
Collateral second.

The user chose Cow / Bull as the first decision. Cow can be fully funded or use Aave collateral. Bull currently offers only Aave collateral. The ghost identifies Aave, while borrowing remains a separate step after funding.

Scope: a new infrastructure home and a working design prototype in herd/. Cow and Cattle retain their files, deployments and live flows. No fully funded Bull is released by this study.

02 · Read and capture before redesigning

Carry the lessons forward.

These are live-page reference captures, not before-screens of Herd. Cow was in fictional sample mode; the two landings were disconnected. Captures: 1920 × 993 CSS px. Read the imagegen design guide, Cow’s journal and Cattle’s journal.

03 · Three hypotheses, not three palettes

Explore, then choose.

A · Open pasture

Selected for the entrance

B · Compact workspace

Adapt selector; reject explanatory copy

C · Collateral becomes visible

Selected for the collateral step

04 · A small coherent slice

Make the journey inspectable.

1. Choose Cow or Bull. The same choice remains available in the builder.
2. Choose assets. The sample marks wstETH / USDC on Base as Aave-capable. WETH / USDC demonstrates the unavailable path. This is a demonstration set, not a new live whitelist.
3. Choose collateral. Cow offers two choices on the supported pair. Bull offers only Aave. No hidden borrowing is added.
4. Set a price, amount and schedule. Keep Cow’s explicit price/date. Aave examples distinguish strategy notional from the collateral supplied later.
5. Review → create → fund. The created sample initially has no supplied assets. Funding is its own action and creates no debt.
6. Manage the position. Borrow and repay are inspectable sample actions. Roll and close open their proposed steps; they do not fabricate quotes, fees, health factors or contract execution.

Each action is native HTML/JavaScript. Theme preference is browser-local and tolerates blocked storage. No example is silently saved as a live position. Live wallet integration and unified portfolio reads are later work.

05 · Character collateral

A little life in the pasture.

Solid characters are awake by day and resting by night. Ghosts rest by day and wake at night. Change the theme above to inspect both rows. The solid Bull is the strategy’s entrance character, not an offered collateral product.

The built-in image tool generated an eight-state RGBA atlas, then a focused extraction/spacing repair. CSS selects the cells; controls and all meaningful text remain native. The art remains decorative. Some soft edge glow survives; visual quality is assessed in the actual page.

Final character atlas ↗ · First asset pass ↗ ·

06 · One brand, sensible destinations

Start with the selector.

Only the infrastructure host is part of this preparation. The consumer domains are proposals. “thetahard.com” is treated as a spelling slip, not another domain to provision. Separate origins do not inherit a wallet connection or local cache automatically.

07 · What the evidence establishes

Test the page,
not just the picture.

The automated checks cover routing boundaries, source failures, supported collateral transitions and invalid plans. The browser walkthrough separately verifies creation, funding, borrowing and repayment. Live browser checks cover desktop and narrow phone layouts, real button interactions, theme changes and console errors.

Current validation record ↗

This is not a measured newcomer comprehension study. The next useful user test: ask someone to choose a strategy, explain what the ghost changes, and find where borrowing begins—without coaching.

08 · 06 October 2026 · The consumer pasture

Bring the selected design to life.

The user chose the pasture direction for the future thetaherd.com consumer site, with team review in /dev/herd/ first. This cycle develops the selected open-pasture composition into a complete landing page and carries its materials, typography and character treatment into the sample journey.

The price-direction illustration uses native SVG and buttons. It explains how the strategies respond to a move; it is not a price forecast, payoff curve or simulated return. A ghost identifies Aave collateral. The landing links directly to a Ghost Cow example. The Aave paths preserve separate creation, funding and optional borrowing. Fully funded Cow now creates and funds in one sample action, matching its atomic factory flow; this corrects the two-step illustration in study 01.

Lessons retained from Cow and Cattle: make the position's identity readable before its balances; distinguish notional from supplied assets; leave a clear path to positions; and do not turn a successful startup or attractive image into a promise of continuous trading.

09 · Artwork with a defined job

The same meadow,
a different light.

The built-in image_gen tool generated the day scene and edited it into the night scene. The existing character atlas supplies awake and sleeping variants. The small brand mark and the sun/moon control are native vector/CSS artwork.

10 · Team review, before publication

Try the whole journey.

Scope: a framework-free consumer design preview using sample assets. No wallet, pricing feed, transaction or deployment has been added. Cow and Cattle remain independent. Thetaherd.com has not been published by this work.

24 automated checks pass. Production-URL browser checks cover both themes, 320/390 px phones, 768 px sample positions and 1440 px desktop views. The tested pages have no horizontal overflow or application console errors. Native controls, collateral routing, invalid-plan recovery, funding and borrow/repay paths were exercised.

For the team's review: choose a strategy, explain what the ghost changes, and find where borrowing starts. Visual preference and successful browser checks do not replace that comprehension check.

11 · 06 October 2026 · Contract generations

September exits.
October in Herd.

The user simplified the migration: keep Cow on September with a deprecated banner, and give Herd the October deployment. Herd's independent trade/ interface uses the exact October deployed manifest and ABIs. Cow's September and August position management, gas rules and worker remain intact.

October recovery freezes its fee rate and recipient at the first close, assesses each token once and reserves unpaid fees. An unassessed zero is unknown. Healthy-token withdrawal, fee assessment and fee payment are separate actions; close remains best-effort. Lifecycle history distinguishes Withdrawn from the PositionClosed summary.

The supplied Solidity handoff requires new creation to stay disabled. The runtime and artifact flags both retain that hold. Hosted-order, worker and token acceptance remain open. The existing gateway's Cow service is still September-only; October views use direct chain reads and say when their service is unavailable.

Generation and verification record ↗

12 · 06 October 2026 · Review and state

Keep the next action clear.

The October trade pages now inherit the pasture's complete day and night palette. Browser inspection caught pale text left over from Cow's dark skin; the corrected colors apply to headings, fields, review cards and sample controls. The same appearance toggle works in the planner and positions.

A successful close receipt does not mean every token was recovered. The interface reads state at or after that confirmation, verifies the block before displaying it, and shows each token's reserved fee and recoverable amount independently. The sample recovery card includes a frozen fee and disabled per-token controls.

Lifecycle history starts at a verified creation event and only advances when two RPC hosts agree. Independent Codex and Opus reviews drove the receipt and history checks. This is frontend integration evidence; October creation remains closed pending the release acceptance work.

Checks, source commits and remaining acceptance ↗

12 · 12 October 2026 · Use reveals the gaps

A real wallet path.
Checks at the action.

The user wants to test the UI with their own wallet. Cow now opens a collateral choice: fully funded Cow leads to the October planner, while Ghost Cow stays an Aave sample. The pasture and moonlit theme continue through the asset directory, activity explorer and reviewer workspace.

Trial creation checks the current order service, recorded token reviews, matching contract code, balances, approvals and the proposed transaction. Later wallet sends repeat the checks. A failed read stops that action; sample mode stays available. Hosted order acceptance is a per-chain prerequisite.

Token evidence lives on Reviewed assets. The planner shows the chosen contracts and the next action without duplicating the full reviewer interface. Try Cow → · Try the fully funded sample →

September exits remain in the deprecated Cow app. Ghost Cow and Bull remain sample journeys. No consumer-domain publication is included.

13 · 12 October 2026 · Browser review

Use the interface.
Then fix the gaps.

The live browser revealed a inherited selector that hid both characters on the new collateral picker. The picker now shows Cow and Ghost Cow. Reviewed asset rows no longer repeat the automated “needs review” caption after a matching human review. Token details have a separate panel gap. A second screenshot revealed light card backgrounds in night mode; the collateral cards now use the same themed Cow treatment as the pasture, with complete character silhouettes.

Wallet connection opens the real wallet selector. Exact-address search and fresh token details use the shared registry. The fully funded sample permits the complete price, amount, date and review journey without a wallet transaction. Day and night, mobile layout, application state and console checks form the acceptance loop.

14 · 13 October 2026 · First wallet trial authorized

A small position
starts the live check.

The user authorized proceeding with the first wallet trial. The only existing October Base position is closed, so initial admission allows a USDC-only deposit of up to 100 USDC into the exact WETH/USDC pair on Base. Other pairs, funding modes and larger deposits wait for a verified October order.

Fresh token reviews, matching code and proxy fingerprints, no-rebase checks, exact amounts, transaction simulation and wallet identity remain required. Every signing step repeats admission. The acceptance record remains useful after a position closes; its API read must still be current.

Start the Base wallet trial → · Use sample assets →

15 · 13 October 2026 · Shared wallet integration plan

One wallet choice.
A complete position lifecycle.

Plan only; not implemented. Add the central passkey wallet as an optional connection for small Base trials. Keep external wallets available for all supported networks and larger positions. Use the central keyring at wallet.thetanuts.finance; do not create another local or temporary wallet.

1. Register an app recipient, not a new vault.

Use the exact https://herd.thetanuts.finance origin with an opt-in preview path. Add an explicit Herd app identity and protocol to the central bootstrap, worker and handoff selectors, the reviewed handoff-origin registry, and the public verification-key GET/OPTIONS boundary. Herd receives no vault API token or tenant access. Passkey authentication stays on the central wallet origin. The shared /dev/herd/ origin remains suitable for ordinary UI and read-only fixtures; it must not become a key-handoff recipient.

2. Add a small wallet adapter inside Herd.

Provide one active-wallet interface for connect, lock/disconnect, public account, chain, signer and generation. Adapt both trade/basic.js and trade/positions.js; their current Web3Onboard-specific provider and signer binding is not a drop-in central connector. Preserve external-wallet delegates and ignore stale events from a previously selected provider. Start the private worker/channel in the first synchronous script, before theme, library or application code. Vendor reviewed signing dependencies locally and update the exact CSP and dated cache tags.

The page receives public metadata, review facts and transaction references only. No private-key or raw-signing API enters Herd's page state. Switching from the planner to the separate positions page ends the current worker: show the saved transaction/position and ask the user to reconnect for signing. Opening vault settings must not silently change the active account. Samples must not start wallet connections.

3. Define a Herd signing policy.

The first passkey policy permits only Base, the October factory, exact WETH/USDC, USDC-only creation up to 100 USDC, the connected wallet as position owner, and exact bounded USDC approvals to that factory. Decode and re-encode canonical calldata in the worker. The worker cap remains fixed even after the frontend's initial posting gate opens. Keep token admission, code/proxy checks, simulation and wallet-context checks; a page-provided readiness flag is not sufficient authority to sign.

Support closePosition(), withdraw(token), assessFee(token) and claimFee(token) for an independently attested October pair with the correct connected owner and pair tokens. Preserve best-effort close and per-token recovery. Recovery is not another deposit and must not be blocked merely because returned assets exceed the original 100 USDC. Keep executeExitStep inaccessible. Ownership transfers, arbitrary rescue, other chains, base/dual funding, arbitrary signatures, Aave operations and Circle/7702 signing remain outside this first passkey policy.

4. Make funding and withdrawal usable.

Show the selected address and Base network for receiving ETH gas and USDC. Use native ETH gas first. Closing can leave WETH and USDC in the wallet, so include decoded withdrawals for both assets with separately reviewed worker limits and explicit destinations. Do not treat WETH's 18-decimal amount as USDC or assume Odette's USDC-only send policy covers it. Agree the WETH valuation/quantity limit and measured creation/recovery gas limits with the wallet agent before implementation is considered complete.

Set capital, fee and transaction-count budgets inside the worker. Approvals must not double-count a later deposit. Reverts and uncertain broadcasts must not replenish reservations. Contract recovery and outward wallet withdrawals have distinct accounting. Session limits apply to that unlock; they are not account-wide or cross-app spending limits.

5. Preserve pending work across disconnects.

Persist a public transaction intent and local hash before acknowledging dispatch. Keep chain, account, action and position/request identity together. Lock, account changes, reload and page navigation must not discard an unresolved submission or trigger an automatic retry. Reconcile the exact receipt before repeating a create. Copy the existing cancellation and uncertain-send protections, but account for Herd's two-page navigation. Current cross-origin nonce coordination remains a limitation when one EOA is used in another app at the same time.

6. Prove the complete flow before enabling the pilot.

Run actual-worker handoff and signing witnesses with disposable keys: wrong origin/app/key/chain, stale owner, token changes, one atomic unit over the cap, wrong factory/spender/receiver, altered calldata, expired plans, hanging reads, lock/switch at each async boundary, pending-hash recovery and budget exhaustion. Cover approval → create → receipt/position discovery → close → partial token recovery → WETH/USDC wallet withdrawal. Run Herd's existing funds-path and wiring checks plus the central wallet/Ranger/Odette regression suites affected by registration.

Then test the opt-in route on the dedicated Herd origin with desktop and mobile passkeys: popup blocked/cancel/retry, unsupported PRF, wallet selection, page-to-page reconnect, external-wallet fallback and readable transaction review. Keep the consumer domain unpublished. A funded trial remains a user-wallet action after the code and device checks.

16 · 13 October 2026 · Optional passkey wallet

The same plan.
One more way to connect.

The pilot adds a passkey choice beside an external wallet. Authentication stays at the central Thetanuts wallet. The selected key reaches only Herd's dedicated worker; the page receives the address, transaction review and public hashes. No temporary wallet is created.

Start with Base WETH/USDC and up to 100 USDC per position. The connected wallet owns the position. Close, per-token recovery and sending WETH or USDC are supported. The wallet panel shows the receiving address, balances and ETH needed for gas. Transfers have explicit token limits: 100 USDC or 0.025 WETH per action. WETH is not labelled as a fixed dollar value.

The pilot is isolated at herd.thetanuts.finance/wallet-pilot/trade/basic.html. Normal Herd, Cow and Cattle routes retain their connection flows. The worker independently checks the October contracts, ownership, token reviews, amounts, transaction simulation and available gas. Recovery and approval revocation remain available during trading-service outages. Tests use real ABI encoding, encrypted handoff and disposable worker signatures without spending funds.

Browser checks cover desktop and phone layouts, day/night, wallet choice, external-wallet fallback, the Herd-labelled central popup and positions navigation. Closing the popup reports cancellation inline. The dedicated route keeps the normal site intact; diagnostics link to their existing pages.

Session caps reset on reconnect and do not limit the wallet balance. One EOA used in another app can still have competing pending transactions. Native device passkeys and a funded create-to-recovery transaction remain user acceptance checks.

17 · 13 October 2026 · Recover an unresolved transaction

Keep the original.
Cancel the same nonce.

The final independent review found that a saved hash with no receipt could block the wallet indefinitely. The wallet now saves its nonce and fee fields before dispatch. It can check the original, or ask the user to confirm an empty replacement at the same nonce. No tokens move in this cancellation. Either the original or the cancellation can confirm; the interface never describes a consumed nonce as a successful deposit.

The journal keeps both hashes until a canonical receipt or confirmed nonce resolves them. One lock covers all wallet addresses on this origin. There is no automatic retry or timed deletion of an uncertain transaction. Close operations keep their bounded gas setting, recovery does not depend on a three-minute device-clock tolerance, and the wallet leaves extra ETH for Base data fees.

18 · 13 October 2026 · Wallet actions have one home

Manage the position here.
Manage the wallet centrally.

The user directed all general wallet actions to the central Thetanuts wallet. Herd now has a direct Manage wallet link with the explanation: “Transfer, bridge, swap and manage your wallet.” The standalone Send form, wallet balances dialog and transfer-signing permission are removed.

Creating a position, closing it, claiming fees, recovering its tokens and resolving its pending transaction remain in Herd. Opening the central wallet does not silently change the account connected to this Herd tab.

19 · 13 October 2026 · Wallet controls belong to Herd

One button family.
One visual language.

The user identified a real component mismatch: the wallet dialogs used generic rectangular green buttons and system text, while the planner used Chivo, Fraunces and pill controls. CSS hashes on the served pages matched the workspace; this was not a stale stylesheet.

The wallet choice, transaction confirmation and pending controls now use the planner's type, pill shape, spacing and theme surfaces. Passkey/confirm is the primary action, external wallet is outlined, and Cancel is quiet. The overlays retain their existing handlers, labels and focus behavior. The central Manage wallet link replaces the old Wallet & Send control.

This is a focused component repair following the design guide. Native CSS is the right medium for these controls; no new raster image or whole-app redesign is needed.

20 · 13 October 2026 · A failed read is not an invalid amount

Keep the reason clear.

The first WETH/USDC wallet trial reached Place it, then the signing worker could not read token reviews. The page used Herd’s gateway, while the worker called the shared service directly and was blocked by CORS.

The worker now reads the same exact token-review routes through Herd. Failed service reads say “Trading checks are unavailable. Try again.” They do not blame the selected amount. Token identity, current contract code, review status and transaction checks still run before signing.

21 · 13 October 2026 · Fewer repeated wallet checks

Keep the checks.
Reduce the waiting.

The first funded wallet trial exposed a burst of RPC requests. Approval now checks current funding, token admission and allowance without repeating the full pricing model before sending. Full model checks and creation simulation still run after approval and before creation. The signing worker combines compatible getters and checks again after confirmation.

Herd uses public network endpoints with sequential fallback and a cooldown after failures. A transaction keeps its checks, nonce and broadcast on one endpoint. A pending hash is retained, and a broadcast is never automatically retried. General wallet controls remain at the central wallet.

22 · 13 October 2026 · Remember the view

Your wallet stays visible.
Trading waits for unlock.

The pilot saves only the public wallet address after a successful connection. Reloading restores holdings and positions with a clear locked state. Unlock starts a fresh wallet connection; changing accounts refreshes the view and clears the previous account’s draft.

Forget removes the viewing preference and cancels an unfinished unlock. It preserves pending transaction records so an uncertain submission can still be resolved. A remembered address never becomes an active signer.

23 · 13 October 2026 · Reviewed tokens in the wallet pilot

Choose the assets.
Confirm the exact amounts.

The Base passkey pilot now supports reviewed token pairs with funding from either asset or both. Each approval names the token and the October factory. The worker independently checks the current token review, contract code, decimals and rebasing probes before confirmation and again before signing.

The trial keeps a 100 USDC estimated-value limit per position and 500 per session. Other assets are valued from current CoW native-price ratios; the confirmation shows exact token amounts alongside the estimate. A missing price stops a new deposit. Closing and recovering an existing position remain available when reviews or pricing are unavailable.

24 · 13 October 2026 · Wallet trial limits

500 per position.
500 per session.

The user raised the position limit to 500 USDC estimated value. The session total stays at 500. The same limits apply to exact token approvals and the combined deposit value. Current token reviews and independent worker checks remain required.

25 · 13 October 2026 · One placement action

Unlock, then place.

A locked wallet could reach review and see “Approve the deposit tokens” while approval was disabled. The review now offers Unlock wallet. After a fresh connection and checks, the Thetanuts wallet has one Place position action. It handles required exact approvals and waits for confirmation before creating. Changing the draft, locking the wallet or an uncertain approval stops the sequence.

The complete deposit is checked against the remaining session budget before approvals, using the same integer valuation as the signing worker. External wallets retain the separate approval step, and the signing worker continues to ask for confirmation of each transaction.

26 · 14 October 2026 · Progress wording

Do not call unfinished work complete.

The final network read now says “Finishing checks…” instead of “Confirming the completed checks…”. The result appears after that read finishes.

27 · 14 October 2026 · Continue after approval

Keep placement moving.

A confirmed token approval was followed by a timeout before the creation confirmation appeared. Preparation, confirmation and final checks now have separate bounded timers. Progress names the current action. A lock or timeout stops the request; a later reply cannot send it.

The final page simulation also keeps the confirmed approval’s block as its minimum. Tests cover slow reads, each timeout stage, pending transaction recovery and a competing wallet transaction during review.

28 · 14 October 2026 · Locked wallet layout

One quiet wallet row.

The user’s screenshot showed repeated lock labels and scattered controls. The wallet strip now groups the status with Manage wallet and Forget. Empty budget and transaction rows take no space. Unlock remains the main header action. Desktop and mobile checks use a remembered public address without a signer.

29 · 14 October 2026 · Public history endpoints

Read the missing blocks.
Use an endpoint that can answer.

The position index was working, but its 742-block catch-up stalled on a throttled Base endpoint before falling back to one that allows only 10 blocks. Position discovery, lifecycle history and funding lookups now use a separate public log pool. Wallet connections stay out of log selection.

Eiko and Gyro contribute free-first selection, endpoint-specific ranges and learned limits. Odette contributes bounded retries and progress tied to completed coverage. Herd keeps its verified index prefix and reads the remaining blocks directly. Rate limits rotate to another host; only an explicit range refusal reduces that host’s range.

Current browser witnesses: BlockPI and bloXroute handled 5,000 blocks, while Tenderly’s public limit is now 1,000. These are dated working sizes. No keyed or metered endpoint is configured. The planner’s optional inbound-token scan is outside this focused migration.

30 · 14 October 2026 · Trial 2 discovery audit

A current index can cover
the wrong generation.

The supplied Cattle short and long positions belong to a newer factory that is absent from both the live registry and the frontend deployment list. Reading more blocks from the older factory cannot discover them. The new lens also removed a field, so changing its address alone would fail to decode.

Record the newer deployment and lens ABI separately, preserve older positions, and give each factory its own verified index coverage. Herd’s fully funded Cow portfolio and the Ghost sample journey remain distinct until the live Cattle portfolio is integrated. This entry records the audit; it does not enable the new deployment.

31 · 14 October 2026 · Current deployments only

Live Ghost positions.
One current generation.

Herd now uses October Cow and Cattle Trial 2. Ghost Cow and Ghost Bull open the live Aave portfolio. The tutorial remains optional. Earlier deployments and their exit links are removed from Herd.

Trial 2 changes more than the factory address. The live flow reads its current lens, preserves the small fee reserves, uses Aave borrowing capacity and checks both supplied assets before a new borrowing approval. Creation, funding, borrowing, repayment, rolling and withdrawal remain separate, reviewed steps.

Indexed positions appear as they are read. Discovery continues in the background; a partial view is labelled as such and never becomes a complete saved snapshot. The locked-wallet controls share one compact row on desktop and phone.

32 · 14 October 2026 · Thetanuts Wallet for Cattle

View first.
Unlock where the status lives.

Thetanuts Wallet now serves the live Cow and Aave routes. A remembered address loads positions while locked. Unlock sits below the status message, rather than in the page header. Unlocking does not submit an old action; current balances and ownership must be reviewed again.

The trial keeps 500 USDC of estimated funding per position and session. Cattle borrowing follows Aave’s current limits. Repayment, rolling and withdrawal remain available after the funding budget is used. Each approval and protocol transaction has its own wallet confirmation.

33 · 14 October 2026 · A consumer home

The pasture has an address.

ThetaHerd lives at thetaherd.com. Cow and Aave positions share the pasture, while herd.thetanuts.finance keeps the infrastructure and testing pages. Both sites use the same current contracts.

Wallet connections and remembered views belong to the site where they were opened. Opening the other site starts a separate connection; it does not carry an unlocked wallet across domains.

34 · 14 October 2026 · Read the position at a glance

Its state.
Your deposit.
A close estimate.

Positions use Active, Warming up or an action that needs attention. Hover or tap the status to learn what it means. A missing order alone does not mean a position must close.

The initial deposit comes from the creation receipt, found through the indexed creation block. During normal trading, Close now values the tokens returned after fees at the inventory-implied mid. It uses the quote asset at or above strike and the base asset below strike. The actual token mix remains visible.

Startup shows token amounts without an auction-price valuation. The final hour uses an estimate explicitly labelled At your price. Viewing a position requests no aggregator quote.

Close estimates require a verified snapshot, show its time and expire after three minutes. Refresh reads current balances before another estimate.

35 · 14 October 2026 · One wallet row

Status left.
Actions right.

The wallet bar keeps View only. Unlock to trade on the left. Unlock wallet, Manage wallet and Forget wallet share a compact group on the right. Phones use one short second row for the actions.