Start with one.Add protection when it matters.

Morning: open the till.

The wallet and its first address are created on the phone immediately. Bitcoin headers can load in the background; Sofía does not wait for the network to write down or copy her recovery phrase.

A customer pays a fresh Taproot address. While Receive is open, Winnow watches a bounded slice of peer relay traffic for an early heads-up. The balance becomes final only when the transaction appears in a block.

Noon: pay the supplier, then fix the fee.

Winnow shows the destination, amount, fee, inputs, and change before it asks the secure key store to sign. It relays the signed transaction directly to Bitcoin peers.

If the fee is too low, Replace-by-Fee creates a higher-fee successor. The history keeps the whole replacement chain instead of pretending the first transaction vanished.

All day: learn without asking for a balance.

Ordinary peers send the same BIP157/158 block summaries they can send to any compact-filter client. Winnow matches those filters against Sofía's scripts on her device and downloads a full block only after a match.

No explorer or indexer receives a list of her addresses. Explorer links remain available for a person who deliberately wants a faster second opinion, but Winnow warns before opening one.

Three roles. Any two signatures.

Sofía moves funds she does not need tomorrow into a Taproot 2-of-3 reserve. Elena holds the owner's role, Leo represents temporary liquidity at an exchange or lender, and Marina represents fiduciary continuity.

Owner + lender can handle an ordinary collateral movement. Owner + trust can migrate after obligations are cleared. Lender + trust can act when the owner is unavailable. Bitcoin sees only valid signatures; contracts and people decide why a pair may sign.

The contract gives the signatures meaning.

If Elena cannot sign, Leo and Marina can use the same 2-of-3 policy after the family's real-world inheritance checks. That continuity is also a control risk: those two institutions are cryptographically able to spend without the owner.

The recovery spend in the story moved funds toward Elena and Mateo's next-generation reserve without using Elena's signature.

One compromised key cannot spend alone.

MuSig2 lets Elena and Mateo combine public keys and signature contributions. Both must participate. The verified story proves Winnow's two-party protocol, but it did not prove compatibility with an independent wallet implementation; that work is planned and tracked.

Reporting about a 2026 Coldcard weak-entropy incident illustrates the boundary: a mixed-wallet threshold could contain one exposed key because the attacker still lacks another signature. The affected key remains compromised, the second wallet may never display the attempted theft, and shared seeds or common failures erase the benefit.

The final spend uses Taproot's key path: no multisig script is revealed, and an observer sees the same witness shape as a single-key Taproot spend.

A backup includes more than twelve words.

Winnow scans forward from a wallet's creation height. Its portable export therefore carries public history and scan state alongside the material the user explicitly chooses to include.

The story imported a redacted-preview seed-bearing bundle into an isolated replacement phone, verified forward, and matched balance, UTXOs, transaction history, replacement links, scan height, and peer connectivity.