“That email and password do not match an account.”
Signing in.
The same sentence covers a wrong password AND an address with no account, and it is deliberately impossible to tell which. Two different answers would turn the sign-in form into a way of finding out who banks here, one address at a time. The app even spends the same amount of work on both, so the timing does not say what the wording will not.
What to doCheck the address first — it is the half people get wrong. Then use the reset link.
“Too many attempts. Wait fifteen minutes and try again, or ask an owner to send you a fresh invitation.”
Signing in, after several failures in a row.
A rolling fifteen-minute limit, counted against your address as well as your email. It exists to make guessing expensive rather than to punish anybody, and it forgets by itself — nothing has to be unlocked and nobody has to be asked.
What to doWait it out. Nothing is locked and nothing has been recorded against the account.
“That account is locked after 5 failed sign-ins. Reset your password to unlock it — the link goes to the address on the account — or ask us to unlock it for you.”
Signing in, after five failures in a row on one account.
A lock is not the throttle above. The throttle forgets after fifteen minutes; this counts 5 CONSECUTIVE failures against one real account and holds until somebody clears it. They answer different attacks — a flood, and the patient attacker who tries six passwords a day for a month, which no rolling window ever notices. You are only told the account is locked once you supply the right password: said to anybody typing addresses it would leak which ones exist.
What to doReset your own password — the link goes to the address on the account and clears the lock — or ask us to unlock it. Unlocking does not change your password.
“This account is locked after 5 failed sign-ins. An administrator has to unlock it; there is no self-service reset on a staff account.”
Signing in to the staff console.
The same rule as a winery account, without the way out: staff accounts have no reset link, so an administrator has to clear it. Administrators themselves never lock, because there would be nobody left able to unlock them.
“That link is no longer valid. Ask for a fresh one — they expire, and each works once.”
Following a password reset or an email verification link.
A link that can be used twice is a password that never expires sitting in an inbox. These are single-use and short-lived, and the check happens inside the same transaction that sets the password, so two tabs racing cannot both win.
What to doAsk for another. There is no limit on how many you may request.
“Please accept the terms to create an account.”
Creating an account.
An account cannot exist without a record of what its owner agreed to, so the box is a real gate rather than a formality — the check is in the write path, not just on the form. What gets recorded is the version AND a hash of the exact text, in the same transaction that creates the account, so the two cannot come apart and the document cannot be edited afterwards without the record showing it.
What to doThe terms are readable in full before you accept, and afterwards, at /terms.
“Tick the attestation to file. The return is signed by the winery, not by us.”
Filing a return.
A federal return is attested to by the proprietor, and this software builds the form rather than submitting it — so the attestation has to be an act somebody takes, not a step the app performs on their behalf. The exact wording shown at the moment of signing is recorded with the acceptance, so what was attested to can be shown later rather than asserted.
“Those two do not match. Type the new password again.”
Changing your own password, on either application.
A password is typed blind and a mistyped one is only discovered at the next sign-in, by which time the old one no longer works. On the staff console that is not a nuisance but a lockout: there is no reset link for a staff account and nobody may set one for somebody else, so the last administrator mistyping this has no way back except psql against the production database. Two boxes cost a moment; the alternative costs an afternoon and a database password.
What to doThe form says whether they match as you type, but the check that decides is on the server — a browser hint is not a boundary.
“Say whose taxpaid wine this is — your own coming back, or wine you bought.”
Entering taxpaid wine back into bond, on the ledger panel.
Both go on the same line of the return, so this changes no figure — and they are not the same fact. Excise your winery paid on its own wine is the case where a credit may be available; excise somebody else paid on wine you bought was never yours to reclaim. Movements are append-only, so a row that does not say which will never be able to, and there is no default that would not be a guess about somebody's tax.
What to doThe app records which it was and works out no credit from it. What you can reclaim depends on rules this app does not model, and a figure guessed here is one you would file.
“Cost of goods is part of Commercial. Change your plan in Settings.”
Recording what something cost.
Cost of goods is for wineries that SELL wine — a cost per bottle is a number you need because you are going to price a case off it, and a hobbyist making wine to drink is not. It rides the same question as the TTB return rather than a second one beside it, so an account either carries the commercial dimension or it does not.
What to doEverything else about the lot — the ledger, the lab, the journal — is unaffected.
“Nothing off this block has become a lot yet, so there is nowhere for the farming cost to go.”
Allocating a season's farming cost on the block screen.
The cost is split across the block's picks by tonnage, and a pick that has not become a lot has no wine to carry it. Rather than guess at a destination, the money stays on the block — where the reconciliation already reports it as spent on no wine — until there is something real to put it on.
What to doCreate the lots for this block's picks, or tie the picks to lots that already exist.
“That period is not over yet, so what the wine used of the cellar is not known.”
Allocating a period's overhead on the reports screen.
Overhead is split by gallon-days — how much wine stood in the building and for how long — and a period still running can still change. Allocating now would have to be corrected on the last day, and correcting an entry here means reversing it, because the cost ledger is append-only. So the cost waits until the period has actually ended and then lands once.
What to doCome back after the last day of the period. It stays listed until you do.
“No wine was in the cellar for that period, so there is nothing for the overhead to land on.”
Allocating a period's overhead on the reports screen.
Rent on an empty building is a real cost with no wine to bear it, and spreading it over lots that held nothing would put cost on wine that was not there. It stays where it is and the reconciliation goes on reporting it as money spent on no wine, which is both the honest answer and the correct accounting one — that is a period expense, not part of a wine's cost.
What to doNothing to do. It stays on the record as spent, and no wine is charged for it.
“This period changed while you were reading it. Reload, check the figures, and file again.”
Filing a return whose status changed between the screen loading and the button being pressed.
The wording you tick is different for an original and for an amendment, and the record keeps a hash of the exact sentence you saw. If somebody else filed this period in the meantime, the sentence on your screen is no longer the one that applies — so the filing is refused rather than recording an attestation to words nobody was shown.
What to doReload the page. The figures and the wording will both be current.
“Written down. It cannot be edited — correct it with another entry.”
Saving a journal entry.
The journal is append-only in the database, not merely in the screen — there is no edit action and no delete action to reach. That is how a paper cellar book works and it is most of why one survives an audit: the record shows what was thought at the time, including what turned out to be wrong.
What to doWrite a second entry saying what you now know. Both stay, in order.
…append-only…
Part of a longer sentence — the rest changes with the lot, the role or the number involved.
Trying to change or remove a ledger entry, a spray, or a journal entry.
Movements, spray applications and journal entries cannot be updated or deleted by anyone — the database refuses, not the screen, and it refuses the database owner too. A ledger that can be quietly edited is not evidence of anything, and a pre-harvest interval that can be edited afterwards is not an interval.
What to doRecord a reversing entry. The mistake and the correction both stay on the record.
“Saved. Filed returns keep the name they were filed under.”
Renaming the winery.
A filed return renders from the snapshot taken when it was filed, never from a recompute. The paper copy carries the old name, so ours has to as well — a reprint that quietly says something different from what was submitted is worse than no reprint.
“Saved. A filed return keeps the address it was filed with.”
Changing the premises or mailing address.
A return names the bonded premises it was filed for. Moving, or correcting a typo in the address, does not change where the wine was when that period was reported — so the filed copy keeps the address it carried, and only returns filed from here on show the new one.
“The records themselves stay. They are append-only by trigger — a cascade from `wineries` is refused by the database, including for the owner role — and a winery's movements back filed TTB returns, which have a retention period. Nothing here can reach them: there is no sign-in on this account and nobody is named on it. When and whether they may be removed is a compliance question, not a schema one.”
Asking for an account to be removed.
The records themselves cannot go: they are append-only by trigger, and a winery's movements back filed returns that have a retention period. What CAN be removed is everything that identifies a person — every sign-in, the names and addresses, the team list — which is what closing an account does. The books stay, with nothing able to reach them.
What to doTake the full archive from Settings first. Closing is refused until you have.
“sugar was added after the must, so gravity cannot give the alcohol”
The blend bench and anywhere a lot's alcohol is shown.
Alcohol from gravity is start-minus-finish arithmetic, and it is right up until sugar goes in after the must — a tirage, a chaptalisation, a wine sweetened and re-fermented. The liqueur puts the gravity back UP, the yeast ferments it, and the figure comes out short by the whole secondary ferment. On a sparkling wine that is wrong by more than a label's legal tolerance.
What to doRecord a measured alcohol on a lab panel. That beats the derivation and is the only honest way to have the number.
“no must analysis, so no alcohol figure”
The blend bench and anywhere a lot's alcohol is shown.
Depletion is measured against the must analysis taken at crush, not against the earliest reading that happens to exist. Treating day three as day zero makes every figure wrong in the same direction with nothing on screen to say so, so the app says it does not know instead.
What to doFill in the lot's starting gravity if you have it, or record a measured alcohol.
…estimated…
Part of a longer sentence — the rest changes with the lot, the role or the number involved.
The blend bench, beside a predicted pH.
Alcohol and TA blend close enough to arithmetic to be called computed. pH does not: it is logarithmic, and a volume-weighted average is wrong by more than the margin that decides an SO₂ addition — which is the one decision pH is used for. The bench shows the estimate and refuses to let it look like a measurement.
What to doBench the blend and measure it. That is what bench trials are for.
…cannot do this — ask…
Part of a longer sentence — the rest changes with the lot, the role or the number involved.
A control your role cannot use.
Roles are narrow on purpose: anyone can record what they did, but changing the numbers a record was judged against, and signing a federal return, are not the same act. The message names who CAN do it rather than just saying no, so it reads as a boundary rather than a wall.
What to doSee who can do what in the reference.
“That fruit is no longer among your plantings — a block or a planting has been removed since it was chosen. Take it off the fruit list above and save again.”
Saving a program whose fruit names a planting that no longer exists.
A plan's fruit points at a planting by id, and the planner keeps unsaved work in the browser so that stocking a nutrient — which means leaving the page — does not lose it. Between writing that draft and coming back, a block edit can remove the planting it named. The app refuses rather than dropping the entry, because a co-ferment share attributed to nothing is still counted by the other shares.
What to doThe picker cannot offer a planting that is gone, so remove that entry and choose the fruit again.
“That grower is no longer on your purchased fruit — it has been removed since it was chosen. Take it off the fruit list above and save again.”
Saving a program whose fruit names a grower that no longer exists.
The same rule a missing planting follows, and it is a separate sentence for a reason: these two used to share one message that named plantings, so a grower that could not be resolved told somebody to look again at their blocks while they were staring at the grower they had just picked. A refusal that misnames what it refused is worse than one that says nothing.
What to doRemove that entry and pick the grower again, or add it back under Purchased fruit.
“Some of that fruit is no longer among your plantings or your growers — it has been removed since it was chosen. Take those entries off the fruit list above and save again.”
Saving a co-ferment where both a planting and a grower have gone.
Both origins failed at once, so naming only one of them would send somebody hunting through the half that was fine. A plan's fruit is a planting OR a grower, never both on one row, and a co-ferment can name several of each.
What to doRemove the entries that no longer resolve and choose the fruit again.
“A trial needs at least two arms — that is what makes it a comparison.”
Setting up a trial.
The whole value of a trial is that everything except one variable was the same. One arm is not a trial, it is a lot with a note on it — there is nothing to compare it against and nothing to conclude.
“An interval of zero days would schedule the next racking for this afternoon. One day at the very least.”
Setting racking intervals in Settings.
A blank or zero interval schedules the next racking for today, every day, for every lot — a task list that is instantly worthless. The app refuses the value rather than storing it and quietly producing nonsense.
“Ten years is not an interval, it is a decision to stop.”
Setting racking intervals in Settings.
The other end of the same guard. A figure that large is a typo or a way of switching the schedule off, and neither should be recorded as if it were a cellar practice.
…No asks left.…
Part of a longer sentence — the rest changes with the lot, the role or the number involved.
The three buttons that put a question to an AI model — yeast suggestions, plan assessment, protocol reasoning.
Everything the app works out itself is included: the protocol, the schedule, the lab arithmetic, every conversion and every check. Asking an AI model is what costs, because each question is a real request to somebody else's service, so those three buttons are metered. What runs out is the month's included asks and anything bought on top of them. Nothing is charged for an answer that came back empty — a refusal, a cut-off reply and one the app discarded whole are all the same thing from where you are standing, and none of them is billed. And nothing tops itself up: running out says so rather than buying more on your behalf.
What to doWait for the month to turn, or add a pack. The rest of the app is unaffected either way.
“This account is suspended for non-payment, so that cannot run right now.”
Anything that reaches the cellar while an account is suspended — the app redirects to the payment page, and a background request says this.
Suspension stops the thing that is not being paid for and nothing else. What it deliberately does NOT touch: signing in, so the owner can see why; the export and the full archive, because the paid tier gates the return and never the ability to leave; and the records themselves, which are not frozen or deleted — a winery is obliged to keep them whatever the invoice says, and answering a billing problem by creating a compliance one would be the wrong trade. Everything comes back intact on payment.
What to doOpen the payment page. Your archive can be taken from there at any point, paid or not.