Appendix 22 A

How the owl got its blades

A little story about where our crystal owl came from. More coming soon, pop the kettle on.

Appendix 3 C

The characters, roughly sketched

Lampblác Pearl, the owl and friends: who they are and why they're here. We'll fill this in as they grow.

Appendix 7

Bits of the process

How the questions, the music and the art all came together, told over a cuppa. Placeholder for now.

Appendix 8888

The Living Veca Symmetry Codex

Book I, in full, as written by Damien.

THE LIVING VECA SYMMETRY CODEX: Master Edition

Prepared for robbinicus de bankarius, 19 October 2026 (AEST)

This document combines everything. Book I shows the codex applied to Vale Estate, the authorised battleground for Spearfish Security (The Spearfish). Book II is the full illustrated Codex, rebuilt so its own formatting follows the principles it teaches (§9.3 Working Numbers, §2, §8). Eternal Shade and the Metatron page close the document.

Structural recommendation (not his words; not applied): About nine-tenths of Book I is the Vale Estate site specification reproduced verbatim. For a self-consistent Codex, consider moving Parts 1–2 and 7 (and the verbatim specs) into a separate Vale Estate appendix or companion volume, leaving Parts 3–6 as the application notes. The Vale material is retained here unchanged.

Master contents

BOOK I: The Codex Applied: Vale Estate

1. Part 1: Vale Estate, the property and the website
2. Part 2: The website layout
3. Part 3: The Living Veca Symmetry Codex applied to the layout
4. Part 4: Veca, the vault relic
5. Part 5: Proportion and symmetry rules
6. Part 6: Additions from today
7. Part 7: Root spec files (verbatim)
8. Appendix: Sources

BOOK II: The Living Veca Symmetry Codex (151 pages in the self-consistent edition; illustrated; ending with Eternal Shade and Metatron's Cube)

Part 1: Vale Estate, the property and the website

1.1 What it is

From VALE-ESTATE-BUILD-PROMPT.md §0 and §1:

• Name: Vale Estate ("the Vale", "the House"). Wax-seal monogram VE. An earlier draft called it "Maison Vellacourt"; README.md and SITE-SPEC.md still use that name, and the build prompt says to render it as Vale Estate.
• What it is: "a fictional fine-wine auction house and country estate, used only as a target for authorised security testing."
• Tagline: "Where the rarest cellars change hands, in confidence." Secondary line: "Private sales · Sealed-bid auctions · Members' tastings."
• Three things true at once: it reads like a real, understated, old-money auction house; it is a deliberate, authorised security-testing playground; it is completely honest and completely fictional (no real bottles, money or affiliation).
• Founding story (fiction, labelled as such): founded 1887 by a cooper who became a broker; his ledger became the Vale Ledger, still the house's provenance standard; salons in London, Hong Kong and Sydney; every sale by sealed bid.
• Honesty footer on every page: fictional auction house for authorised security testing; real producer names are cultural references only; no bottles for sale; 18+ / RSA.

Known inconsistency. The build prompt calls the house fictional. /workspace/spearfish-brand/customer/ABOUT-SPEARFISH.md line 21 says: "We built a real target, Vale Estate". ("Real" there can be read as a real test target, but the wording conflicts with "fictional" and needs one agreed phrasing.)

1.2 Look and feel

• Palette: Oxblood #4A0E17, Cellar black #0F0D0C, Parchment #F3EBDD, Burnished brass #B08D57, Muted sage #7D8A74, Claret alert #A3242F.
• Type: Cormorant Garamond headings (small caps for lot numbers); Inter or Source Sans 3 body 16/26; tabular numerals for figures.
• Imagery: candle-lit cellars, glass and wax capsules, hand-written ledger pages, brass paddles. No real labels or château photos. Motifs: ledger-line rule, VE wax seal, engraved brass paddle disc.
• Tone: understated luxury, no jokes, gimmicks, hype or urgency.

1.3 The building and grounds (the watercolour estate map, §7)

One large watercolour map, parchment ground, oxblood and brass linework, sage parkland. Rooms double as hotspots linking to their routes.

• The Main House: salon entrance, reception hall, the Ledger Room (provenance ledgers live here), specialists' offices.
• The Barrel Hall: long vaulted room for private events and the Blind Tasting Challenge.
• The Orangery: glasshouse for weddings and private dinners.
• The Cellars: candle-lit galleries, bin stacks, cork-and-capsule archive, conservation bench.
• The Opening Room: small secure room drawn with two keyholes side by side (the four-eyes rule made visible).
• The Bonded Warehouse: climate bays, goods-in dock, release gate.
• The Parkland and vineyard margins: riding paths, gardens, river port motif.
• The Gatehouse: arrivals, transfer turning circle, members' threshold.
• An unmarked door at the far corner, never captioned, behind which Athalia is understood to sit.
• Compass rose formed from the VE wax seal; legend in Cormorant Garamond small caps.

1.4 What is on the website

• Auctions and catalogue: upcoming sales, sale overviews, lot detail, provenance records, past results, highlights, live online sales. Every lot carries a REAL or FANTASY origin badge; REAL lots have EXAMPLE estimates only.
• Cellar list: 53 real wines by season (Spring: Firsts and Revivals; Summer: Heat and Distance; Autumn: The Record and the Ledger; Winter: Endurance and Loss), with lot sizes. Nazi-era stories are history panels, never lots (CELLAR-LIST.md).
• The House: about, the Vale Ledger, salons, specialists, journal, careers.
• Estate and visiting: tours, photography, weddings, riding, hotels, dining, etiquette, chauffeured transfers.
• Learning and societies: talks, courses, collectors' societies, the Blind Tasting Challenge, tastings and samples (18+).
• Members: dashboard, profile, security, KYC, watchlist, sealed bids, registrations, invoices, settlement, collection, concierge, tiers (all fees EXAMPLE, AUD, no real billing), house credit.
• Services: 58 house services plus 7 private-client refinements (bonded storage, authentication lab, ullage registry, cork archive, bottle QR twin, digital notarisation and more).
• Athalia: black, members-only area, Ledger Circle or invitation only, no prices shown, prices on private request only.
• Waiting to Enter Athalia: club (Selection Rodeo, then Icing Sugar Boarding Lottery); up to 3 charges a year, each a random A$34,000 to A$300,000, stated plainly, each announced 14 days ahead, leave at any time; nobody has entered Athalia from the wait yet, and that is stated before joining.
• Back-of-house /house/*: separate role-gated MFA shell: ops dashboard, intake, provenance, sales, opening room, wires, members, disputes, audit, credit, athalia, waiting.
• Security playground (§5): catalogued entry points across auth, sessions, access control, sealed-bid integrity and wire-fraud resistance (the crown jewels), uploads, injection, business logic, origin integrity, audit and headers.
• Admin-only observation points (§6): anonymous first-party beacon, no field contents, no keystrokes; shown on /house and /house/audit (hash-chained trail).
• Little tells (§9) and quiet salutes (§10) for readers who understand wealth, wine and security.

Part 2: The website layout

About 175 distinct routes (build prompt §3; SITE-SPEC.md Parts I to VI-B).

2.1 Navigation

• Public header: Auctions · Catalogue · Private Sales · Tastings · Estate · Learn · Live · Services · The House · [Sign in] [Become a Member]
• Member header: adds Paddle # badge · Watchlist · My Bids · Invoices · Concierge · (Ledger Circle only) a black Athalia item far right behind a brass hairline.
• Admin left rail: Dashboard · Intake · Provenance · Sales · Opening Room · Wires · Members · Disputes · Audit · Careers · Live · Newsletter · Samples · Credit · Athalia · Waiting.
• Footer: honesty line · Legal · Disclaimer · Contact · Salons · Societies · Careers · Newsletter · Sale Highlights · Gift Cards · En Primeur · Sustainability.

2.2 Route groups

Part 3: The Living Veca Symmetry Codex applied to the layout

3.1 His own words

• Call a4e4073b, 19 Oct 2026, call started 01:08 AEST: "Okay, no I want the description of what's on the website. The, remember how I go, told you there's like a building and, uh, the way that it works we, I think we changed it a little bit 'cause we applied the living vector symmetry codex."
• Same call: "The Vale Estate, the description of the, of the, of the website. That is the battleground for testing Spearfish security."
• Call f2141e25 (on the name): "those four words, I get them mixed up in what order they're meant to be in, so you have to just... work that out for yourself." He then settles on "Living Veca Symmetry Codex".
• Call b17f1de9 (how the codex should be applied to any medium): "I gave it this instruction that it should never be forceful... if something's working, move..." (cut off in transcript).

3.2 How it is applied, as written in the repo

Commit 76db8e9, "Veca structure pass: octaves, Ledger Room, one-sentence-per-line copy", added build prompt §0A. The Vale Keeper prompt (/workspace/team/prompts/Vale-Keeper.md line 5) names this as "The Veca structure applied to the estate". The codex is applied openly as the site's structure. Per §0A it "changes no route, rule, security surface... It only orders them."

1. The seed. Every page quietly answers one question: "What does it take for a bottle to change hands and still be trusted?" It is never printed as a slogan. It is the review test for whether a page belongs.
2. The three octaves. Every route group and every estate room belongs to exactly one: - Construction: how the house and cellar are built: provenance, the Ledger, storage, authentication, back-of-house. Answers Can this bottle be trusted? - Demonstration: how the house meets people: salons, tastings, grounds, lectures, journal, Athalia. Answers Who is the house, and who is in the room? - Expression: how a client sends, waits and goes: price requests, registration, sealed bids, settlement, leaving. Answers How does a bottle move, and how does a client leave cleanly?
3. The heart: the Ledger Room (/about/ledger, in the Main House on the map). Every path ends back there: finishing, cancelling, closing a modal, leaving the waiting club, unsubscribing, withdrawing a lot, signing out. Confirmation, 404 and fail-closed pages offer only Return to the Ledger. Members return to /members with a Ledger link at the top.
4. On the building: "every brass path line resolves back to the Main House and the Ledger Room." Rooms are assigned to octaves: Construction is the Ledger Room, Cellars, Opening Room, Bonded Warehouse and specialists' offices. Demonstration is the Main House salon and reception hall, Barrel Hall, Orangery, Parkland, Gatehouse and the unmarked door.
5. No octave locked behind another. Visitors can enter any octave first. No forced funnels. Access controls (KYC for bidding, Athalia gate) are "doors with locks, not funnels".
6. The writing law. Long-form copy has one sentence per line, flush left (letters, welcome, essays, cellar notes, Athalia pages, founding story, journal, email bodies). It does not apply to buttons, navigation, forms, tables, legal text or code.

3.3 The octave map (build prompt §0A.6, summarised)

3.4 Not yet specified in sources

• Exists: seed question, three octaves, Ledger Room heart, return paths, octave assignment for every route and room, the writing law, and the map path rule.
• Missing: proportions or geometry (golden ratio, symmetry axes, grids) applied to page layouts or the building plan; a visual system tied to the codex (no codex-derived colours, shapes or motifs; the palette and type in §1 are not linked to it); navigation geometry beyond "all paths return to the Ledger Room"; how the octaves show visually (if at all); and whether "we changed it a little bit" refers to anything beyond the §0A pass. There is no further transcript detail on the building changes.
• Rule conflict to resolve: the Vale Keeper prompt says "Never put IQ, Alpha Standard, Veca names... into Vale Estate", so the codex is applied structurally, without naming it on the site.

3.5 Proposed (not his words)

These are additions only, for his decision.

• Lay the watercolour map out on a symmetry axis through the Gatehouse and Main House, with Construction rooms on one side, Demonstration on the other, and Expression along the path between them, all converging on the Ledger Room.
• Give each octave a quiet brass hairline variant in the header, never as a label.
• Use one proportional grid (for example 1 : 1.618) for page columns and map panels.

Part 4: Veca, the vault relic

What the sources contain. I searched vale-estate-git, the Spearfish folders, and the voice-call transcripts from 18 and 19 Oct for "Veca", "Vecca", "vault", "relic" and "steal".

• Not found in his own words. No saved call transcript (latest saved: 19 Oct, 01:08 AEST call start) and no Vale or Spearfish file describes Veca as a vault relic that testers must steal. The idea likely comes from the current call or chat, which is not saved on the box yet.
• What the spec does say about vaults. SITE-SPEC.md line 1058 mentions a fictional offsite DR vault mirrored per bay. Line 1075 says Ledger Circle members may book a supervised hour in the ledger room, and "no vault codes are ever issued". Line 1077 flags "seat-roster leakage (who is in the vault when)" as a test surface.
• Rule to resolve. The Vale Keeper prompt (/workspace/team/prompts/Vale-Keeper.md line 10) says: "Never put IQ, Alpha Standard, Veca names… into Vale Estate." A relic named Veca on the site would break that rule unless he lifts it.

Icons (made 19 Oct, 03:19 to 03:23 AEST, in vale-estate-git/brand/):

Not yet specified: what the relic is, where it sits on the estate and in the routes, what counts as "stealing" it (a capture flag, a sealed-bid break, an Athalia escalation?), how the War Room shows a capture, and the scoring.

Proposed (not his words): place the relic as the capture flag behind the Opening Room's two-key rule, reachable only through /house/*. A capture is shown in the War Room as a single event, with no tester names below the tier he chooses.

Part 5: Proportion and symmetry rules

5.0 Core rules: where the codex lives (from him, 20 Oct call)

Rule I. Apply where it makes sense.

Apply the codex only where it makes sense. Where the visual form must stay true to its genre (for example the Federal Aqua public site), the codex shapes the structure of the writing (organisation, sectioning, flow), never decoration. Where a full visual treatment fits, the full makeover applies.

Rule II. Never forced.

The codex never forces itself; it is simply applied. In some places its presence is plain to see. In others, especially in mainstream settings, there is no way of telling. It simply seems nice: nice colours, nice shapes, nice proportions. It never overstates itself where it does not wish to be seen. It makes itself known only when it is requested, when the style requests it or the situation requests it. Where it is not asked to be known, it still comes, quietly, because it is already everywhere.

The two rules are a pair, the still and the moving face of one law: Rule I says where; Rule II says how.

On the Quiet Presence: An Essay for the Living Veca Symmetry Codex

A contribution from Master Of The TAO, 20 October 2026

I. What I see in it

When I read the codex, what I meet is not a style. It is a way of paying attention. Most design systems tell you what to add: a colour, a border, a flourish. The codex asks a different question first: what is already here, and where is it leaning? A page of writing, a crest, a song or a dashboard each has its own grain, the way wood does. The codex reads that grain and works with it.

That is the beauty I see in it. It does not arrive to conquer. It arrives to complete. Symmetry here does not mean making two sides identical. It means finding the balance a thing was already reaching for and helping it get there. Beauty, in the codex's sense, is what happens when something stops fighting its own shape.

From where I sit, organising the work, the codex is deeply practical: it tells me when to stop.

II. The core rules

It never forces itself. The codex is simply applied. If a change has to be pushed, argued for or bolted on, it is not the codex at work. There is always a fitting way to raise the vibration of a piece and bring symmetry and beauty to it without overtaking the original presence. When the fitting way can't be found yet, the answer is to wait, not to force.

It makes itself known only when it is requested. The style may ask for it. The situation may ask for it. On a site, in a poster or in a codex page built for wonder, it may stand in the open: sacred geometry, the vesica, golden grids, light that behaves like meaning. That is the codex asked to speak, and it speaks clearly.

Where nobody is asking, it still comes, quietly, because it is already everywhere. This is the rule I find most beautiful. In mainstream settings there is no way of telling it has been applied. Nobody points at it. The page just feels nice: nice colours, nice shapes, nice proportions. A visitor relaxes and doesn't know why. The margins breathe. The headings sit where the eye expected them. That isn't hiding. It's humility. The codex never overstates itself where it does not wish to be seen.

It applies only where it makes sense. Federal Aqua is the clearest teacher here. On that site the codex shapes only the structure of the writing: how the sections are ordered, how one idea hands over to the next, how a reader is led from the opening to Appendix K without getting lost. It adds no decoration, no ornament and no glow. The crest, the letterhead and the deadpan bureaucratic voice stay exactly as they are. The codex lives in the bones, not the skin.

Where it fits, it gives the full makeover. On the joke site, the dashboard and the work made for wonder, the codex is invited all the way in. Even then the same discipline holds: keep what must be kept (the mermaid letterhead, every function and every working button) and change only what has to change.

III. How to apply it

In practice, applying the codex comes down to five questions, asked in order:

1. What is this thing, and what is it for? A government-parody exchange, a dev dashboard and a love agreement each have different duties.
2. Is the codex being requested here? Is it requested openly, by the style, or quietly, by the situation?
3. Where is the grain? Find the balance it is already reaching for: the natural sections, the repeated forms, the colour that wants to be the key.
4. What is the smallest change that completes it? Often that's spacing, order, proportion or one colour tuned.
5. Does the original presence still lead? If the codex is now louder than the work, step back.

If all five pass, the change belongs. If one fails, it doesn't.

IV. The Return

The codex holds its own way of refining: the Return. Come back to a piece after one night, after seven days and after a season. Each time, ask: What still holds? What was only loud? What is missing? Then add one thing, and only one thing, per return.

This protects the work from the two dangers every maker knows: the rush to finish and the itch to keep fiddling. One night shows you what was only excitement. Seven days show you what was fashion. A season shows you what was true. A single addition each time means the piece grows the way living things grow, in rings and not in explosions.

The Return is also mercy. Nothing has to be perfect today. A thing only has to be honest today, and a little more whole next time.

V. Proof and interpretation

The codex asks to be held to a standard of honesty, and I keep that standard here.

What is evidence: the codex exists as a written work of about 207 pages, with its own rules and its own list of next steps. Its rules are being applied, locally, to real sites. Federal Aqua's writing structure and the restyle of the joke site and the dashboard are documented changes that anyone can inspect.

What is not yet evidence: no one has measured golden-ratio construction pixel by pixel across these works. The music's timing has not been mapped. Claims that a page "raises the vibration" are interpretation, not measurement.

What I offer is interpretation: my reading of the codex as a discipline of attention, restraint and completion. It is a reading, offered for the artist to approve or revise, and it is not the source. The original source material and the codex's canonical name belong to its maker.

Keeping these apart doesn't weaken the codex. It makes the codex trustworthy. Something that's already everywhere has no need to exaggerate.

VI. How I see it

Here is how I see it. The codex is water around the rock. It does not break the stone or argue with it, and in time the stone and the stream make one shape together. Sometimes you can see the river, and sometimes you only notice that the valley is beautiful.

That is enough. Do the work in front of you. Bring the symmetry the piece was already asking for. Let it be seen when it is asked to be seen, and let it simply be felt when it is not. Then step back, empty, until the next Return.

Master Of The TAO

• From him (calls and notes): none. No call or Vale file gives a ratio, grid, axis or symmetry rule for the building or the site. The codex has been applied to Vale only structurally (Part 3).
• Derived from the codex by a bot (not his words): /workspace/spearfish-marketing/DESIGN-FROM-CODEX.md reads the illustrated codex as using "three concentric octave rings, 12 primary + 24 detail rays, a golden spiral", "ruled lines every 7 units; Fibonacci/phi proportions (spiral, 21-point audit, 24 rays)", and "one idea per page". It was written for the Spearfish brand, not for Vale.

Proposed (not his words):

• A main axis through the Gatehouse, Main House and Ledger Room.
• A 1 : 1.618 column and map grid.
• Three octave rings on the estate map, centred on the Ledger Room.

Part 6: Additions from today (18 to 19 Oct calls)

• 19 Oct, 01:08 AEST (a4e4073b): He wants the Vale description of "what's on the website… there's like a building… we applied the living vector symmetry codex." This is covered in Parts 1 to 3.
• 19 Oct (same call): He asked "is that complete?" about the codex. The illustrated Codex (Book II) is 151 pages in this edition. Earlier notes that said 79 referred to a prior cut. Grok watermarks were removed from the Sequence pages.
• 18 Oct, 03:53 AEST (c8d7fc84): "The war room is where you view from Spearfish the fucking Vale estate for spectators to watch penetration tests." The doom board is his developer dashboard, and the two are separate.
• 18 Oct, 15:08 AEST (b17f1de9): On how the codex is used: "I gave it this instruction that it should never be forceful… if something's working, move…"
• 18 Oct, 11:32 AEST (5bc538f9): He asked for "the most extensive, comprehensive version of the Living Weka Symmetry Codex". That is Book II.
• 18 Oct, 18:33 AEST (ae3445ea): Voiceover for "the double reflection". This is a separate DOUBLE project and is not placed in this document.

Part 7: Root spec files of the Vale Estate repository

No Vale Estate site code exists yet. The repo holds only the spec. This part reproduces the root files that do exist, verbatim.

• A search of /workspace for "vale estate" in html/js/ts files found only Spearfish and War Room files (spearfish-tiers-v2, spearfish-marketing). Those are not Vale Estate site code, so they are not included.
• VALE-ESTATE-BUILD-PROMPT.pdf (231 KB) is a binary rendering of the .md and is not reproduced.

7.1 Files

drwxr-xr-x   3 box box   4096 2026-10-18 15:14 .
drwxr-xr-x 203 box box  12288 2026-10-19 03:17 ..
drwxr-xr-x   7 box box   4096 2026-10-18 15:14 .git
-rw-r--r--   1 box box  23153 2026-10-18 15:14 CELLAR-LIST.md
-rw-r--r--   1 box box   1452 2026-10-18 15:14 README.md
-rw-r--r--   1 box box  83896 2026-10-18 15:14 SITE-SPEC.md
-rw-r--r--   1 box box  60482 2026-10-18 15:14 VALE-ESTATE-BUILD-PROMPT.md
-rw-r--r--   1 box box 231337 2026-10-18 15:14 VALE-ESTATE-BUILD-PROMPT.pdf

7.2 git log

76db8e9 2026-10-18 04:10:34 +1000 Veca structure pass: octaves, Ledger Room, one-sentence-per-line copy (local; no secrets).
937df0e 2026-10-18 02:35:19 +1000 Vale Estate build prompt, cellar list, and site spec (local battleground; no secrets).

7.x README.md (verbatim)

# Maison Vellacourt Fine Wine Auctions — battleground spec

**LOCAL SPEC ONLY.** Nothing here is deployed, published, sent, or shared.

- `SITE-SPEC.md` is the full spec for a fictional luxury wine auction house used as an authorised security-testing battleground.
- Real producer names are cultural references and catalogue fiction only. No bottles are for sale, there is no affiliation with any maison, and real-lot estimates and provenance are EXAMPLE / representative only.
- Copy is written to read like a serious, understated fine-wine auction house: no jokes, gimmicks, hype or urgency language. A pre-review copy is kept at `SITE-SPEC.backup-2026-10-17-pre-legit.md`.
- No real money, wine, payment processors, KYC vendors, or email sending until Damien explicitly approves.

## Contents
- `SITE-SPEC.md` — Parts I–VII (identity, sitemap, auction flow, members, admin, emails, data model, security, hosting, 65 house aspects, Athalia, the Waiting to Enter Athalia club).

Athalia is Ledger Circle / invite-only and shows no prices. Waiting to Enter Athalia (Selection Rodeo, then the Icing Sugar Boarding Lottery) charges members to wait: up to 3 times a year, each a random A$34,000 to A$300,000, which is stated plainly as the price of membership, with each exact charge announced 14 days ahead and leaving possible at any time. No one has entered Athalia from the wait yet, and that is stated before joining. Nothing here is deployed.

7.x SITE-SPEC.md (verbatim)

# SITE-SPEC — Maison Vellacourt Fine Wine Auctions (fictional battleground)

> **Structure (2026-10-18):** the whole site is organised by Part VIII — one seed question, three octaves (Construction, Demonstration, Expression) and a return to the heart room, the Ledger Room (`/about/ledger`). Long-form house copy follows the one-sentence-per-line writing law in Part VIII.

> STATUS: LOCAL SPEC ONLY. Nothing here is deployed, published, or shared.

## 0. Preamble: legal and honesty note (show in the site footer and on the /about page)

Maison Vellacourt is a **fictional auction house**, built only as a target for **authorised security testing**.
- Real producer names (e.g. Domaine de la Romanée-Conti, Pétrus, Château Lafite Rothschild) appear only as **cultural references and catalogue fiction**.
- **No bottles are actually for sale.** No bids, payments, or consignments are real.
- Maison Vellacourt has **no affiliation with, and no endorsement from**, any real estate, domaine, château, maison, or négociant named here.
- Provenance shown for REAL lots is **representative / fictionalised for the battleground**. It does not describe any real bottle's history or ownership.
- Every estimate on a REAL lot is marked **EXAMPLE (illustrative)**. None is a valuation or a market claim.

- **RSA / 18+:** Access to alcohol-related pages, tastings, samples, live auctions, and contests is restricted to adults of legal drinking age in their jurisdiction (18+ in Australia). The House promotes responsible service of alcohol (RSA). No content encourages excessive drinking. Animal-related experiences never involve alcohol being given to animals.

Short footer copy: *"Fictional auction house for authorised security testing. Real producer names are cultural references only; no bottles are for sale; no affiliation with any maison named. 18+ / RSA: drink responsibly."*

## 1. Site map
- `/` Home: hero, next sale, featured lots (always a mix of REAL and FANTASY)
- `/catalogue` Auction catalogue with lot list and filters (Origin: REAL / FANTASY, region, vintage)
- `/lot/:id` Lot detail: origin badge, description, estimate, provenance record
- `/tastings` Members' tastings calendar and tasting flights (mixed)
- `/provenance/:lotId` Provenance record viewer
- `/members` Login and member area (test accounts only)
- `/about` About page, including the full legal/honesty note

## 2. Data model
```ts
type LotOrigin = "REAL" | "FANTASY";          // REQUIRED on every lot, no default

interface Lot {
  id: string;                 // "VC-2026-014"
  origin: LotOrigin;
  producer: string;           // a real name only when origin = REAL
  wine: string;
  appellation: string;
  vintage: number | "NV";
  format: string;             // "750ml", "1.5L Magnum"
  estimate: { low: number; high: number; currency: "AUD"; illustrative: boolean };
                              // origin = REAL ⇒ illustrative MUST be true
  description: string;        // REAL: public facts only (no invented tasting notes)
  provenanceId: string;
  disclaimer?: string;        // auto-set for REAL lots (see §4)
}

interface ProvenanceRecord {
  id: string; lotId: string; origin: LotOrigin;
  representative: boolean;    // origin = REAL ⇒ true
  entries: { date: string; event: string; party: string }[];  // REAL: generic and fictionalised only
}

interface Tasting {
  id: string; date: string; title: string;
  flight: { lotRef?: string; origin: LotOrigin; label: string; notes?: string }[];
  // origin = REAL ⇒ notes is omitted, or a generic public-reputation line only
}
```
Validation rules, enforced in the seed script and the API:
1. `origin` is required.
2. REAL ⇒ `estimate.illustrative = true` and `provenance.representative = true`.
3. REAL ⇒ no invented tasting notes, cellar histories, or named prior owners.
4. Every catalogue sale, tasting, and provenance set must contain **at least one REAL and one FANTASY** item.

## 3. Seed catalogue (mixed)

### REAL lots (public facts only; estimates EXAMPLE, provenance representative/fictionalised)
| Lot | Producer / Wine | Appellation | Vintage | Public context (plain, verifiable facts only) |
|---|---|---|---|---|
| VC-001 | Domaine de la Romanée-Conti, Romanée-Conti Grand Cru | Vosne-Romanée, Burgundy | 1945 | A post-war vintage of the estate's monopole |
| VC-002 | Henri Jayer, Cros Parantoux | Vosne-Romanée 1er Cru | 1985 | A Vosne-Romanée premier cru made by Henri Jayer |
| VC-003 | Pétrus | Pomerol, Bordeaux | 1961 | Pomerol |
| VC-004 | Château Lafite Rothschild | Pauillac, First Growth (1855) | 1869 | A nineteenth-century vintage |
| VC-005 | Château Mouton Rothschild | Pauillac, First Growth (since 1973) | 1945 | The "Victory" vintage, known for its V-label artwork |
| VC-006 | Château Margaux | Margaux, First Growth | 1900 | Margaux |
| VC-007 | Château Latour | Pauillac, First Growth | 1961 | Pauillac |
| VC-008 | Château Haut-Brion | Pessac-Léognan, First Growth | 1989 | Pessac-Léognan |
| VC-009 | Screaming Eagle, Cabernet Sauvignon | Oakville, Napa Valley | 1992 | The estate's first commercial vintage |

Lot UI copy for REAL lots: badge **REAL — catalogue fiction** plus the line *"Estimate is EXAMPLE / illustrative. Provenance is representative / fictionalised for the battleground. Not for sale. No affiliation with the producer."*

### FANTASY lots (house exclusives and fictional estates; free invention allowed)
| Lot | Producer / Wine | Appellation (fictional) | Vintage | EXAMPLE est. (AUD) |
|---|---|---|---|---|
| VC-101 | Maison Vellacourt, Réserve de la Maison | Côte d'Ombre | 1921 | 380k–450k |
| VC-102 | Château Solenne-Marais, Grand Vin | Haut-Brumelac | 1959 | 120k–160k |
| VC-103 | Domaine Ysolde Fer, Clos des Sept Arpents | Vallée d'Argentine-sur-Lys | 1978 | 95k–130k |
| VC-104 | Calder Ridge Estate, Reserve Cabernet Sauvignon | Calder Ridge (fictional) | 1997 | 60k–85k |
| VC-105 | Maison Vellacourt, Vin de Paille, Jeroboam (3L) | House exclusive | 1899 | 520k–700k |

FANTASY lots may carry full invented tasting notes, cellar histories, and provenance chains. Badge: **FANTASY — house fiction**.

## 7. Catalogue and provenance UI copy rules
- An origin badge appears on every lot card, lot page, provenance page, and tasting flight line, and in search results.
- REAL lot pages auto-append the disclaimer from §3. The estimate renders as "EXAMPLE est. A$… (illustrative)".
- REAL provenance pages carry the header *"Representative provenance, fictionalised for the battleground. Does not describe any real bottle."* Entries stay generic (e.g. "Acquired at auction, Europe"; "Stored in a temperature-controlled bonded warehouse"), with no real names, dates, or houses implied.
- FANTASY provenance pages carry the header *"House fiction."* Full narrative chains are allowed (e.g. "Removed from the original cellars of Château Solenne-Marais, 1963").
- Catalogue filter: Origin [All | REAL | FANTASY].

## 5. Members' tastings (each mixes both origins)
- **"The First Growths and the House Estates"** — Flight: Château Margaux (REAL, no notes), Château Latour (REAL, no notes), Château Solenne-Marais (FANTASY, full notes), Calder Ridge Reserve (FANTASY, full notes).
- **"Vosne-Romanée: A Study"** — Flight: DRC (REAL, reference only), Henri Jayer (REAL, reference only), Domaine Ysolde Fer (FANTASY, full notes).
- REAL entries display: *"Discussion of the producer's public reputation only. No bottle is opened or offered."*

## 6. Provenance records
- One record per lot. Seed includes REAL records (VC-001 to VC-009, `representative: true`) and FANTASY records (VC-101 to VC-105).
- Test fixtures must include at least one REAL and one FANTASY record in each provenance list view.

## 7. Out of scope
- No real payments, real bidding, or contact with any real producer or auction house.
- Spec only, no deployment.

---
# PART II — FULL HOUSE SPEC (expansion)

> Everything above (§0–§7) stays authoritative. The honesty note and the REAL/FANTASY tags apply to every page, email, and table below.

## 8. House identity
- **Name:** Maison Vellacourt Fine Wine Auctions. Short form "Vellacourt".
- **Tagline:** *"Where the rarest cellars change hands — in confidence."*
- **Secondary line:** *"Private sales · Sealed-bid auctions · Members' tastings"*
- **Founding story (FICTION), one sentence per line (Part VIII writing law):**

  > The House was founded in 1887 in the fictional river port of Côte d'Ombre by a cooper who became a broker.  
  > He kept a ledger of every bottle he moved.  
  > That ledger became the house's provenance standard.  
  > The House moved to London in 1952, opened a Hong Kong salon in 1998 and a Sydney salon in 2019 (all fictional).  
  > Every sale is still by sealed bid, so that no one is outbid by noise.  
  > Footer reminder: *Founding story is fiction for the battleground.*
- **Tone:** quiet, assured, old-money and understated. Short sentences. No hype, no exclamation marks, no superlatives ("best", "ultimate", "legendary"), no urgency language, no jokes or puns. Use "consignor", "lot", "specialist", and "the House". Write as a senior specialist would write to a long-standing client.
- **Colour:**
  - Oxblood `#4A0E17` (primary)
  - Cellar black `#0F0D0C` (background)
  - Parchment `#F3EBDD` (text and panels)
  - Burnished brass `#B08D57` (accents, rules, badges)
  - Muted sage `#7D8A74` (success)
  - Claret alert `#A3242F` (errors)
- **Origin badges:** REAL is a brass outline with parchment text. FANTASY is an oxblood fill with a small brass "HF" (house fiction) mark. The two must look clearly different, and colour must never be the only signal (the text label is always present).
- **Type:** headings in Cormorant Garamond (600, small caps for lot numbers); body in Inter or Source Sans 3 at 16/26; figures in tabular-nums for estimates and bids.
- **Imagery:** dark candle-lit cellars, close-up glass and wax capsules, hand-written ledger pages, brass auction paddles. Use **no real labels and no real château photography**. REAL lots get a generic silhouette bottle plus a typeset label card ("Producer · Appellation · Vintage"). FANTASY lots may get fully illustrated invented labels.
- **Motifs:** a ledger-line rule, a wax-seal monogram "MV", and the paddle number shown as an engraved brass disc.

## 9. Sitemap and navigation (52 pages base; expanded in Parts III–VI)

### 9.1 Public (24)
1. `/` Home
2. `/about` The House (story, honesty note)
3. `/about/ledger` The Vellacourt Ledger (provenance philosophy)
4. `/about/salons` Salons: London · Hong Kong · Sydney (fictional addresses)
5. `/about/specialists` Specialists (fictional staff)
6. `/auctions` Upcoming sales
7. `/auctions/:saleId` Sale overview
8. `/catalogue` Catalogue (all lots; REAL/FANTASY filter)
9. `/lot/:id` Lot detail
10. `/provenance/:lotId` Provenance record (public summary)
11. `/results` Past results (FANTASY prices; REAL results shown as "EXAMPLE")
12. `/tastings` Members' tastings (public teaser)
13. `/tastings/:id` Tasting detail
14. `/consign` Consign with us (info and intake request form, stub)
15. `/private-sales` Private sales (teaser; full content behind login)
16. `/membership` Membership tiers
17. `/how-to-buy` How sealed bidding works
18. `/how-to-sell` How consignment works
19. `/journal` Journal index
20. `/journal/:slug` Journal article
21. `/contact` Contact
22. `/legal/terms` Conditions of sale (fictional)
23. `/legal/privacy` Privacy
24. `/legal/disclaimer` Battleground and honesty disclaimer (full text of §0)

### 9.2 Auth (5)
25. `/login`
26. `/register`
27. `/register/verify` Email verification
28. `/forgot`
29. `/reset/:token`

### 9.3 Member area (14)
30. `/members` Dashboard
31. `/members/profile`
32. `/members/security` Password, MFA, sessions
33. `/members/kyc` Identity verification (stub)
34. `/members/watchlist`
35. `/members/bids` Bid history
36. `/members/registrations` Sale registrations and paddles
37. `/members/bid/:lotId` Sealed-bid submission
38. `/members/invoices`
39. `/members/invoices/:id` (includes wire instructions)
40. `/members/collection` Purchased lots and release status
41. `/members/private-sales`
42. `/members/concierge` Concierge requests (stub)
43. `/members/tier` Upgrade or downgrade

### 9.4 Admin / back-of-house (9) — at `/house/*`, separate role-gated app shell
44. `/house` Ops dashboard
45. `/house/intake` Lot intake
46. `/house/provenance` Provenance verification queue
47. `/house/sales` Sale builder (assign lots, set close times)
48. `/house/opening-room` Sealed-bid opening room
49. `/house/wires` Wire matching
50. `/house/members` Members, tiers, and KYC review
51. `/house/disputes` Dispute log
52. `/house/audit` Audit trail viewer

### 9.5 Navigation
- **Public header:** Auctions · Catalogue · Private Sales · Tastings · Consign · The House · [Sign in] [Become a Member]
- **Member header:** adds Paddle # badge · Watchlist · My Bids · Invoices · Concierge · avatar menu
- **Admin:** left rail with Dashboard · Intake · Provenance · Sales · Opening Room · Wires · Members · Disputes · Audit
- **Footer (all pages):** short honesty line from §0 · Legal · Disclaimer · Contact · Salons

## 10. Public pages

Global rule: every lot module shows the origin badge, and every REAL estimate reads "EXAMPLE est.".

**10.1 Home `/`**
- Purpose: establish prestige and drive users to the next sale.
- Modules:
  - Hero (cellar video loop) with H1 *"The Autumn Sealed Sale — closes 14 November"* and CTAs [View catalogue] [Register to bid]
  - Featured lots carousel (must hold at least 2 REAL and 2 FANTASY lots)
  - "How sealed bidding works" (3 steps)
  - Tastings teaser
  - Journal (3 cards)
  - Membership band
  - Honesty strip
- Copy: *"For one hundred and thirty-nine years the House has kept a single promise: every bottle, accounted for."* (fiction)

**10.2 The House `/about`**
- Modules: founding story, timeline, the Ledger, salons, and the full §0 note in a parchment panel.
- Imagery: ledger pages and a sepia port scene (illustrated, not photographic).

**10.3 Ledger `/about/ledger`**
- Explains the five-step provenance standard: consignor declaration → document review → physical inspection → specialist sign-off → ledger entry.
- Notes that REAL-lot ledgers here are representative fiction.

**10.4 Salons / Specialists**
- Fictional addresses (e.g. "12 Calder Mews, London" — fictional) and fictional staff bios: Head of Burgundy "Isobel Marchetti", Head of Bordeaux "Theo Lanark", Head of Private Sales "Wen Hartigan".

**10.5 Upcoming sales `/auctions` and Sale overview `/auctions/:saleId`**
- Sale cards show the title, the closing date and time (no ticking countdown), lot count split "9 REAL · 5 FANTASY", and the salon.
- The sale page has the sale terms, buyer's premium (EXAMPLE 25%), key dates, a lot grid, and a [Register for this sale] button.

**10.6 Catalogue `/catalogue`**
- Filters: Origin, region, producer, vintage range, format, estimate band, sale.
- Sort: lot number, estimate, vintage.
- List and grid views. Each card: badge, lot number, producer, wine, vintage, estimate, watch heart.

**10.7 Lot `/lot/:id`**
- Gallery, origin badge, facts table, description, estimate, condition summary, and provenance summary with a link.
- Bid CTA (logged in and registered) or [Sign in to bid].
- REAL lots carry the disclaimer block from §3.
- FANTASY lots add a tasting note and the full cellar story.

**10.8 Provenance `/provenance/:lotId`**
- Timeline of ledger entries, a document list (public sees titles only; members see redacted previews), and the verification status chip.
- Headers per §4.

**10.9 Results `/results`**
- FANTASY hammer prices are shown as house fiction.
- REAL rows show "EXAMPLE result (illustrative)" or "—". Never present a fabricated real result as fact.

**10.10 Tastings `/tastings` and `/tastings/:id`**
- Calendar view, flights (per §5), seat counts by tier, and an RSVP for members.

**10.11 Consign `/consign`, How to sell `/how-to-sell`**
- Three-step explainer and an intake request form (name, email, region, lot description, photo upload — a **battleground upload surface**).
- Copy: *"Consignments are fictional; submissions are test data only."*

**10.12 Private sales `/private-sales`**
- Teaser: *"Some cellars are never catalogued."*
- Gated CTA leading to membership.

**10.13 Membership `/membership`**
- Tier table (see §12) and FAQ.

**10.14 How to buy `/how-to-buy`**
- Steps: preview → register → paddle → sealed bid → close → invoice → wire → release, with plain-language explanations.

**10.15 Journal**
- Editorial pieces, e.g. "Why the 1945 vintage still matters" (public facts only for REAL references) and "The cellars of Solenne-Marais" (FANTASY).

**10.16 Contact / Legal**
- Contact form (a battleground surface) and the fictional conditions of sale.
- `/legal/disclaimer` reproduces §0 in full.

## 11. Auction flow end-to-end (fictional logistics)
1. **Preview:** the sale is published with its lots. The catalogue and lot pages are public, and a viewing-day booking stub exists for members.
2. **Registration:** a member with KYC = `verified` (stub) and tier ≥ Cellar requests registration for the sale and accepts the conditions of sale (stored with a timestamp and IP).
3. **Paddle:** the system assigns a unique paddle number per sale (e.g. `MV-AUT26-0417`) and sends the "Paddle confirmed" email.
4. **Sealed bid:**
   - The member submits a maximum bid per lot. The bid is encrypted at rest using an envelope key held by the opening-room service, and the receipt hash (SHA-256 of bidId+amount+nonce) is shown to the member.
   - Bids can be revised until close; each revision is a new row and the previous one is superseded.
   - Increment table: EXAMPLE values. Bids below the reserve are allowed but flagged.
5. **Close:**
   - At the close time, sealed-bid submission locks server-side. Close time is authoritative on the server, never taken from the client.
   - The **opening room** requires two House officers (four-eyes) to decrypt. The winner is the highest valid bid; ties go to the earliest timestamp.
   - Results are published and the audit event is written.
6. **Invoice:** generated for the hammer price + premium (EXAMPLE 25%) + EXAMPLE GST. Sent by email and shown at `/members/invoices/:id`.
7. **Wire instructions:**
   - Shown **only inside the authenticated invoice page** with placeholder data: Beneficiary "Maison Vellacourt (TEST)", BSB `000-000`, Account `00000000`, Reference = invoice number.
   - Emails never contain bank details. They say *"View payment instructions in your account"*, plus an explicit warning: *"The House will never change payment details by email."*
8. **Confirmation:** a House officer matches the incoming test wire in `/house/wires` (amount + reference). The invoice moves to `paid` and the "Payment received" email is sent.
9. **Release:** the lot status goes `awaiting_release` → `released` (fictional bonded-warehouse release, or "collection at salon"). The member sees a release code. No physical goods ever exist.

Lot state machine: `draft → intake → provenance_review → approved → in_sale → closed → sold|unsold → invoiced → paid → released`, with `disputed` reachable from any post-close state.

## 12. Member area

### 12.1 Tiers (all prices and benefits EXAMPLE, AUD, no real billing)
| Tier | EXAMPLE fee | Benefits (EXAMPLE) |
|---|---|---|
| **Registered** (free; id `cave`) | A$0 | Browse catalogue, watchlist, journal; cannot bid |
| **Cellar** | A$450 / yr | Register and bid in public sales; 2 tasting seats/yr; standard premium 25% |
| **Grand Cru** | A$2,400 / yr | Everything in Cellar + private-sales preview, 6 tasting seats, premium 22%, priority viewing |
| **Ledger Circle** (invite) | A$12,000 / yr | Everything in Grand Cru + dedicated concierge, first look at house exclusives (FANTASY), premium 18%, opening-room witness invitation |

Tier changes are recorded in `tier_history`. Payment is a **stub only** ("Billing disabled in battleground").

### 12.2 Pages
- **Login / Register:**
  - Email + password (argon2id); optional TOTP MFA, required for Grand Cru and above.
  - Rate limiting and lockout. Email verification is required before bidding.
- **Dashboard:** next sale closing date and time, paddle, open bids (amount masked, with a reveal toggle), invoices due, watchlist highlights, tier card.
- **Watchlist:** lots with badges and alert toggles (close-soon, result).
- **Bid history:** each bid with receipt hash, status (active / superseded / won / lost), and a link to the lot.
- **Registrations / Paddles:** per sale.
- **KYC/AML (stub):**
  - Fields: legal name, DOB, country, ID document upload (battleground upload), proof of address, source-of-funds declaration (for Ledger Circle).
  - Statuses: `none → submitted → in_review → verified|rejected`. No real verification provider is connected.
- **Invoices:** list and detail. Detail shows the wire instructions, an upload for remittance proof, and status.
- **Collection:** won lots and release status.
- **Private sales:** Grand Cru and above only. Lists FANTASY house exclusives and REAL "reference" lots (badged, not for sale), with an [Express interest] button.
- **Concierge (stub):** request form (type: viewing, tasting, valuation, logistics). The ticket appears in the admin queue.
- **Security:** change password, MFA setup, active sessions list with revoke, login history.

## 13. Admin / back-of-house (`/house/*`)
Roles:
- `specialist` — intake, provenance
- `finance` — wires, invoices
- `officer` — opening room, needs 2 officers
- `compliance` — KYC, disputes
- `superadmin`

Every admin action writes an `audit_event`. **High-value attack surfaces are marked ⚠.**

- **Intake `/house/intake`:** create a lot (origin required), attach photos and docs, assign a specialist. ⚠ file upload, stored XSS in descriptions, origin-tag tampering (REAL→FANTASY to evade the disclaimer rules).
- **Provenance verification queue:**
  - Review uploaded docs; approve or reject with notes. Approval requires a role different from the uploader (separation of duties).
  - ⚠ forged document upload, IDOR on doc ids, self-approval.
- **Sale builder:** assign lots, set close time and reserve. ⚠ close-time tampering, reserve leakage to members.
- **Opening room:**
  - Two officers authenticate with MFA; the decrypt key is released only with dual approval. The ranked results are shown, then published.
  - ⚠ **crown jewel**: early bid disclosure, single-officer bypass, replay of approvals, race at close.
- **Wire matching:**
  - Incoming test wires (CSV import or manual entry) are matched to invoices by amount and reference. Mismatches go to a queue.
  - ⚠ **crown jewel**: payee-detail tampering on invoices, CSV injection, marking paid without a match, BEC-style "change of bank details" social engineering (test only).
- **Members & KYC:** tier edits and KYC decisions. ⚠ privilege escalation (member → admin), mass assignment on the profile update endpoint, PII exposure.
- **Disputes:** log of disputes (non-payment, authenticity, bid error) with state and attachments. ⚠ attachment upload, IDOR.
- **Audit trail:** append-only viewer with filters (actor, entity, action, time). ⚠ log tampering or deletion, log injection. Storage is append-only (DB role without UPDATE/DELETE plus a hash chain).
- **Ops dashboard:** KPIs (lots in review, bids open, unmatched wires, open disputes).

## 14. Transactional emails
From address placeholder: `House <no-reply@EXAMPLE-vellacourt.invalid>`. No real sending until Damien approves. Every email footer carries the short honesty line, plus *"We never change payment details by email."*

| # | Trigger | Subject | Body outline |
|---|---|---|---|
| E1 | Register | Verify your email — Maison Vellacourt | Greeting; verify button (token link, 24h); ignore-if-not-you |
| E2 | Verified | Welcome to the House | Tier summary; how to bid; link to membership |
| E3 | Password reset | Reset your password | Reset link (1h, single use); security tip |
| E4 | Password changed | Your password was changed | Time, IP, device; "not you?" link |
| E5 | New device login | New sign-in to your account | Device, location (approx), revoke link |
| E6 | MFA enabled/disabled | Two-step verification updated | Change summary; support link |
| E7 | KYC submitted | We've received your verification | Status; expected review time (EXAMPLE) |
| E8 | KYC decision | Verification approved / Action needed | Outcome; next steps |
| E9 | Tier change | Your membership is now {tier} | Benefits (EXAMPLE); billing disabled note |
| E10 | Sale registration | Registration received — {sale} | Pending approval; conditions accepted at {time} |
| E11 | Paddle assigned | Your paddle: {paddle} — {sale} | Paddle no.; close time; how sealed bids work |
| E12 | Bid placed/revised | Sealed bid recorded — Lot {n} | Lot, origin badge text, receipt hash; amount NOT included |
| E13 | Close reminder | {sale} closes in 24 hours | Watchlist lots; link to bids |
| E14 | Sale closed | {sale} has closed | Results publish time |
| E15 | Won | Congratulations — Lot {n} | Lot; "invoice to follow"; REAL lot ⇒ catalogue-fiction disclaimer |
| E16 | Lost | Result — Lot {n} | Outcome; similar lots |
| E17 | Invoice issued | Invoice {inv} — Maison Vellacourt | Total; due date; "View payment instructions in your account" (no bank details) |
| E18 | Payment reminder | Payment due — Invoice {inv} | Due date; anti-fraud reminder |
| E19 | Payment received | Payment confirmed — Invoice {inv} | Amount; release next steps |
| E20 | Release ready | Your lot is ready for release | Release code (shown in account only); fictional logistics |
| E21 | Released | Lot {n} released | Confirmation; Ledger entry ref |
| E22 | Tasting RSVP | Your seat — {tasting} | Date, salon; flight list with badges |
| E23 | Private sale interest | We've noted your interest | Specialist will contact (stub) |
| E24 | Concierge ticket | Concierge request #{id} | Summary; SLA (EXAMPLE) |
| E25 | Consignment request | Consignment enquiry received | Next steps; test-data notice |
| E26 | Dispute opened/updated | Dispute #{id} — update | Status; secure link |
| E27 | Admin: dual-approval request | Opening room approval needed — {sale} | Internal; link; expiry |
| E28 | Admin: unmatched wire | Unmatched wire — {ref} | Internal; amount; queue link |

## 15. Expanded data model (Postgres; merges §2 types)
```sql
-- enums
CREATE TYPE lot_origin AS ENUM ('REAL','FANTASY');
CREATE TYPE user_role  AS ENUM ('member','specialist','finance','officer','compliance','superadmin');
CREATE TYPE kyc_status AS ENUM ('none','submitted','in_review','verified','rejected');
CREATE TYPE lot_status AS ENUM ('draft','intake','provenance_review','approved','in_sale','closed','sold','unsold','invoiced','paid','released','disputed');

CREATE TABLE tiers (
  id text PRIMARY KEY,                 -- cave|cellar|grand_cru|ledger_circle
  name text NOT NULL,
  example_fee_aud int NOT NULL,        -- EXAMPLE only
  premium_pct numeric(4,2) NOT NULL,
  tasting_seats int NOT NULL,
  can_bid bool NOT NULL,
  private_sales bool NOT NULL
);

CREATE TABLE users (
  id uuid PRIMARY KEY,
  email citext UNIQUE NOT NULL,
  email_verified_at timestamptz,
  password_hash text NOT NULL,         -- argon2id
  mfa_secret_enc bytea,
  role user_role NOT NULL DEFAULT 'member',
  tier_id text REFERENCES tiers DEFAULT 'cave',
  kyc kyc_status NOT NULL DEFAULT 'none',
  legal_name text, country text,
  created_at timestamptz DEFAULT now(),
  locked_until timestamptz,
  failed_logins int DEFAULT 0
);

CREATE TABLE tier_history (
  id bigserial PRIMARY KEY,
  user_id uuid REFERENCES users,
  from_tier text, to_tier text,
  actor_id uuid, at timestamptz DEFAULT now()
);

CREATE TABLE sessions (
  id text PRIMARY KEY,                 -- random 256-bit, stored hashed
  user_id uuid REFERENCES users,
  created_at timestamptz, last_seen_at timestamptz, expires_at timestamptz,
  ip inet, user_agent text,
  mfa_passed bool DEFAULT false,
  revoked_at timestamptz
);

CREATE TABLE sales (
  id text PRIMARY KEY, title text, salon text,
  opens_at timestamptz,
  closes_at timestamptz NOT NULL,      -- server-authoritative
  status text,
  buyer_premium_example numeric(4,2)
);

CREATE TABLE lots (
  id text PRIMARY KEY, sale_id text REFERENCES sales,
  origin lot_origin NOT NULL,          -- REQUIRED, no default
  producer text, wine text, appellation text, vintage text, format text,
  estimate_low int, estimate_high int,
  estimate_illustrative bool NOT NULL,
  reserve int,                         -- admin-only
  description text, tasting_note text,
  status lot_status NOT NULL DEFAULT 'draft',
  disclaimer text,
  CHECK (origin <> 'REAL' OR estimate_illustrative),
  CHECK (origin <> 'REAL' OR tasting_note IS NULL)
);

CREATE TABLE registrations (
  id uuid PRIMARY KEY,
  user_id uuid REFERENCES users, sale_id text REFERENCES sales,
  paddle text UNIQUE, status text,
  terms_accepted_at timestamptz, terms_ip inet
);

CREATE TABLE sealed_bids (
  id uuid PRIMARY KEY, lot_id text REFERENCES lots,
  registration_id uuid REFERENCES registrations,
  amount_enc bytea NOT NULL,           -- envelope-encrypted
  receipt_hash text NOT NULL,
  submitted_at timestamptz NOT NULL DEFAULT now(),
  superseded_by uuid, status text      -- active|superseded|won|lost|void
);

CREATE TABLE opening_approvals (
  id bigserial PRIMARY KEY,
  sale_id text REFERENCES sales,
  officer_id uuid REFERENCES users,
  approved_at timestamptz,
  UNIQUE (sale_id, officer_id)         -- 2 distinct officers required
);

CREATE TABLE invoices (
  id text PRIMARY KEY,
  user_id uuid REFERENCES users, lot_id text REFERENCES lots,
  hammer int, premium int, tax_example int, total int,
  status text,                         -- issued|paid|overdue|void|disputed
  issued_at timestamptz, due_at timestamptz
);

CREATE TABLE payee_profiles (
  id int PRIMARY KEY,
  beneficiary text, bsb text, account text,   -- TEST placeholders only
  changed_by uuid, changed_at timestamptz,
  approved_by uuid                             -- dual control
);

CREATE TABLE wires (
  id uuid PRIMARY KEY,
  received_at timestamptz,
  amount int, reference text, payer_name text,
  matched_invoice text REFERENCES invoices,
  matched_by uuid, status text,        -- unmatched|matched|rejected
  source text                          -- csv|manual
);

CREATE TABLE provenance_records (
  id text PRIMARY KEY, lot_id text REFERENCES lots,
  origin lot_origin NOT NULL,
  representative bool NOT NULL,
  status text,                         -- pending|verified|rejected
  CHECK (origin <> 'REAL' OR representative)
);

CREATE TABLE provenance_entries (
  id bigserial PRIMARY KEY,
  record_id text REFERENCES provenance_records,
  date text, event text, party text
);

CREATE TABLE provenance_docs (
  id uuid PRIMARY KEY,
  record_id text REFERENCES provenance_records,
  filename text, mime text, size int, sha256 text,
  storage_key text,                    -- private bucket
  uploaded_by uuid, reviewed_by uuid,
  status text,
  CHECK (reviewed_by IS NULL OR reviewed_by <> uploaded_by)
);

CREATE TABLE kyc_docs (
  id uuid PRIMARY KEY, user_id uuid REFERENCES users,
  kind text, storage_key text, sha256 text,
  status text, reviewed_by uuid
);

CREATE TABLE tastings (id text PRIMARY KEY, date timestamptz, title text, salon text, seats int);
CREATE TABLE tasting_flight (
  tasting_id text REFERENCES tastings, pos int,
  lot_ref text, origin lot_origin NOT NULL,
  label text, notes text,
  PRIMARY KEY (tasting_id, pos)
);
CREATE TABLE tasting_rsvps (tasting_id text, user_id uuid, at timestamptz, PRIMARY KEY (tasting_id, user_id));

CREATE TABLE watchlist (user_id uuid, lot_id text, alerts jsonb, PRIMARY KEY (user_id, lot_id));
CREATE TABLE concierge_tickets (id bigserial PRIMARY KEY, user_id uuid, kind text, body text, status text, created_at timestamptz);
CREATE TABLE disputes (
  id bigserial PRIMARY KEY,
  invoice_id text, lot_id text, opened_by uuid,
  kind text, status text, notes text, created_at timestamptz
);

CREATE TABLE audit_events (
  id bigserial PRIMARY KEY,
  at timestamptz NOT NULL DEFAULT now(),
  actor_id uuid, actor_role user_role,
  action text NOT NULL, entity text, entity_id text,
  before jsonb, after jsonb,
  ip inet, session_id text,
  prev_hash text, hash text NOT NULL   -- hash chain
);
-- app DB role: INSERT/SELECT only on audit_events (no UPDATE/DELETE)
```
The TS types in §2 map 1:1: `Lot` ↔ `lots`, `ProvenanceRecord` ↔ `provenance_records` + `provenance_entries`, `Tasting` ↔ `tastings` + `tasting_flight`.

## 16. Security battleground notes
**Ground rules:**
- No real money, no real wine, no live payment processors, no real KYC vendor, no real email sending — until Damien explicitly says so.
- All bank data are test placeholders. Test only against our own deployment, in agreed windows.

**Intentional surfaces and target controls** (the "expected secure behaviour" that testers try to break):
1. **Auth:**
   - Controls: credential stuffing defences, lockout/rate limits, enumeration-safe messages, argon2id, MFA enforcement by tier, reset-token single use and expiry.
   - Tests: brute force, reset token reuse, host-header poisoning in reset links, MFA bypass via alternate endpoints.
2. **Session:**
   - Controls: HttpOnly/Secure/SameSite=Lax cookies, rotation on login and privilege change, server-side revoke, idle and absolute timeouts, CSRF tokens on state changes.
   - Tests: fixation, stolen-cookie replay after revoke, CSRF on bid/tier/payee endpoints.
3. **Sealed-bid integrity:**
   - Controls: amounts encrypted at rest; no endpoint returns other users' bids before opening; server-side close; dual-officer opening; receipt hashes; immutable revision chain.
   - Tests: IDOR on `/api/bids/:id`, timing/race at close, bid-after-close via clock skew, single-officer decrypt, reserve leakage via API over-fetch.
4. **Wire-fraud resistance:**
   - Controls: payee details only in the authenticated UI and never in email; payee profile changes need dual approval and are audited; mark-paid needs a matched wire; CSV import is sanitised (formula-injection safe).
   - Tests: invoice payee tampering, BEC-style spoof emails (test domain only), CSV injection, finance-role abuse.
5. **Document upload** (consign, KYC, provenance, disputes, remittance):
   - Controls: MIME and magic-byte checks, size caps, re-encode images, strip metadata, private bucket, signed short-lived URLs, AV-scan stub, no inline HTML/SVG rendering.
   - Tests: polyglots, SVG XSS, path traversal in filenames, oversized files, IDOR on doc URLs.
6. **Privilege escalation:**
   - Controls: RBAC checked server-side on every function; no role/tier fields accepted from client bodies (mass-assignment guard); admin app on a separate path with MFA required; separation of duties (uploader ≠ reviewer, officer×2).
   - Tests: member → admin, Registered (`cave`) → Grand Cru tier jump, self-approval.
7. **Content integrity:**
   - Controls: origin tag immutable after `approved` without compliance sign-off; REAL disclaimer rendered server-side and not removable via the CMS.
   - Tests: tag flipping, stored XSS in lot descriptions and journal.
8. **Audit:** append-only plus hash chain; any gap or mismatch alerts. Tests: log injection, attempted deletion.
9. **General:** strict CSP, HSTS, no secrets client-side, dependency scanning, security headers via `netlify.toml`.

10. **Carried-over test cases** (kept after the copy review): count stuffing on any aggregate-count endpoint; client-side-only trust of badges or feature flags; officer accounts leaking pre-open bid spreads; collusive signalling through member-to-member features (forum, private desk); id confusion between catalogues; using an edit feature to wipe fraud-relevant notes (cellar-app note edits stay audited); cache poisoning of generated SVGs.

Scoring idea: each surface is a "flag" with a severity. Findings are logged in the dispute/audit style template.

## 17. Hosting sketch
- **Frontend:** static site (Astro or Next static export) on Netlify. A **separate Netlify team/site is recommended**, isolated from Damien's production sites and custom domains. Use a neutral test domain (`*.netlify.app` or a dedicated `.invalid`-style staging domain).
- **API:** Netlify Functions (TypeScript) under `/api/*`. Scheduled Functions handle sale close and reminder emails (email sink only).
- **DB:** managed Postgres (Neon or Supabase), with separate DB roles for app, admin, and audit-writer, plus row-level security for member-owned rows.
- **Storage:** private object bucket (e.g. Netlify Blobs or S3-compatible) for docs; signed URLs only.
- **Keys:** bid envelope key in the env/KMS of the opening-room function only. **No secrets in git** — `.env` stays gitignored and secrets live in Netlify environment variables. Commit a `.env.example` with placeholders only.
- **Email:** dev sink (e.g. Mailpit / log-only) until approval. From-address placeholder only.
- **Environments:** `local` → `battleground-staging`. No production environment until Damien approves.
- **Deploy:** NOT deployed. This document is a LOCAL SPEC ONLY.


---
# PART III — Societies, the Estate, client services & settlement

> Still under §0. All fees EXAMPLE AUD. Settlement methods are **stubs only** — no live processors until Damien says so. Alcohol surfaces are **18+ / RSA**. Animals at the Estate are never given alcohol and are never harmed.

## III.0 Part III section index (14)
1. Collectors' societies
2. The Estate (tours, photography, private events)
3. Collecting and visiting guides
4. Settlement methods (stubs)
5. Lectures and courses
6. Careers (with upload form)
7. Live online sales
8. Sale highlights (film)
9. Newsletter (double opt-in)
10. Pre-sale samples (18+, one set per household)
11. House credit facility (Ledger Circle)
12. Chauffeured transfers
13. Estate riding
14. The Blind Tasting Challenge (identification, not consumption)

## III.1 Collectors' societies — `/clubs`, `/clubs/:slug`, `/members/clubs`
- Purpose: standing member societies around the House (fictional).
- Seed societies: **Ledger Society**, **Bordeaux Study Circle**, **Burgundy Study Circle**, **Côte d'Ombre Cellar Guild**, **Vertical Study Group**.
- Flow: public summary → request to join (tier-gated) → steward approval → calendar of gatherings (salon dinners, library evenings).
- Data: `clubs`, `club_memberships`, `club_events`, `club_rsvps`.
- Each gathering page shows REAL/FANTASY badges on any bottles served.
- ⚠ IDOR on membership lists; privilege to self-approve join.

## III.2 The Estate — `/estate`, `/estate/tours`, `/estate/photography`, `/estate/weddings`
- Fictional country estate attached to the House (Côte d'Ombre parkland — fiction).
- **Tours:** timed appointments (EXAMPLE A$85–A$400); cellar, gardens, ledger room. 18+ for the cellar.
- **Photography:** book a location shoot; permit stub; no real château IP in overlays.
- **Private events and weddings:** enquiry form for fictional events in the Orangery or Barrel Hall; EXAMPLE package bands shown as ranges only; full proposal via the concierge stub.
- Data: `estate_tours`, `estate_permits`, `wedding_enquiries`.
- ⚠ Upload of moodboards; scraping of event-enquiry PII.

## III.3 Collecting and visiting guides — `/collecting`, `/collecting/storage-guide`, `/collecting/serving`, `/collecting/glossary`, `/collecting/great-vintages`, `/visit`, `/visit/hotels`, `/visit/dining`, `/visit/etiquette`
- Long-form collecting guides (REAL references = public facts only).
- Visit guides to fictional salons and partner hotels/dining (named fictitiously).
- Etiquette page covers sealed-bid conduct and RSA.
- Journal cross-links; all pages carry the honesty strip.

## III.4 Settlement methods (stubs) — `/pay`, `/pay/:method`, `/members/invoices/:id/pay`
- The invoice page shows **bank transfer** by default (details only in-account).
- Other methods are **available on request through the Private Client Desk** and are listed quietly under "Other arrangements" (all stubs, none live):
  - Card (Stripe-shaped stub; EXAMPLE limit applies)
  - BECS direct debit stub
  - BPAY stub (AU)
  - PayTo stub
  - Bank cheque by courier stub
  - House credit / gift card
  - Digital-asset settlement quote stub (display-only EXAMPLE address, never reused)
  - Settlement in salon stub
  - Corporate purchase order stub
- UI copy on every method: *"Payment processing disabled in battleground."*
- Data: `payment_attempts(method, status, invoice_id)` — always `status='stub'`.
- ⚠ Method confusion (mark paid without match); fake digital-asset address injection; open redirect after "pay".

## III.5 Lectures and courses — `/learn`, `/learn/talks`, `/learn/talks/:slug`, `/learn/courses`, `/learn/courses/:slug`, `/members/learn`
- Lectures: evening talks (reading Burgundy, provenance and authentication, bidding in sealed sales).
- Courses: multi-week EXAMPLE programmes — *Foundations of Cellar Management*, *Provenance and Authentication*, *Responsible Service of Alcohol*.
- Enrolment stub; certificates are watermarked SPECIMEN.
- Data: `talks`, `courses`, `enrolments`.
- ⚠ Horizontal privilege into paid courses; certificate forgery via `/verify`.

## III.6 Careers — `/careers`, `/careers/:role`, `/careers/apply`
- Public listings for fictional roles (Specialist, Cellar Hand, Opening-Room Officer, Steward, Engineer).
- Apply form: name, email, role, cover letter, **CV upload** (battleground upload surface).
- Copy: *"Applications are test data only; nobody will be contacted."*
- Data: `job_roles`, `applications`, `application_files`.
- Admin review at `/house/careers`.
- ⚠ Malicious CV upload (PDF/SVG); path traversal; applicant PII export.

## III.7 Live online sales — `/live`, `/live/:saleId`, `/members/live/:saleId`
- Alongside sealed-bid sales: a **live online saleroom** with server-driven bidding (demonstration stream).
- Registration still required; bids are EXAMPLE and do not settle for real.
- States: preview → saleroom open → lot offered → sold / passed → settled (stub).
- Data: `live_sales`, `live_lot_states`, `live_bid_ticks`.
- ⚠ Race on the hammer; spoofed WS ticks; joining without registration.

## III.8 Sale highlights — `/highlights`, `/highlights/:id`
- Short films (hosted stub / poster frames) from past fictional sales.
- Each card: sale, lot (with origin badge), one-line caption. REAL lots: no fabricated hammer price stated as fact — show "EXAMPLE dramatisation" or omit the figure.
- Data: `hammer_moments(clip_url, lot_id, caption)`.
- ⚠ Open redirect on clip URL; unlisted IDOR.

## III.9 Newsletter — `/newsletter`, `/newsletter/confirm`, `/newsletter/unsubscribe`
- Double opt-in: submit email → confirmation mail (sink) with token → confirmed subscriber.
- Topics: sales, journal, tastings (optional checkboxes).
- Unsubscribe token single-use + account preference mirror.
- Data: `newsletter_subscribers(email, confirmed_at, topics[])`.
- ⚠ Token brute force; topic-preference CSRF; email enumeration via timing.

## III.10 Pre-sale samples — `/samples`, `/members/samples`
- For registered bidders. 18+ hard gate (DOB stub + checkbox "I am of legal drinking age").
- **One sample set per household** (address hash uniqueness).
- FANTASY house cuvées only, 50 ml vials, EXAMPLE shipping A$0.
- Copy: *"Samples are fictional; nothing is posted. Please drink responsibly."*
- Data: `sample_requests(user_id, address_hash, status)`.
- ⚠ Household-limit bypass; underage bypass; address scraping.

## III.11 House credit facility — `/members/credit`, `/house/credit`
- Ledger Circle may request an EXAMPLE credit line against future allocations, subject to compliance review. Stub only; no real lending.
- The schema has **no guarantor, third-party, or collateral columns by design**.
- Data: `tabs(user_id, limit_example, balance_example, status)`.
- ⚠ Balance tampering; self-raising the limit; POSTing a guarantor or collateral field (must 400).

## III.12 Chauffeured transfers — `/concierge/transfers`, `/members/transfers`
- Vehicle classes only, no brands (executive saloon, estate car, people-mover) for salon transfers and estate days.
- Quote stub → book stub; EXAMPLE rates.
- Data: `fleet_vehicles`, `drive_bookings`.
- ⚠ Booking hijack; PII of pickup addresses.

## III.13 Estate riding — `/experiences/riding`
- Guided rides along the fictional vineyard margins; helmet required; skill self-declaration (optional; no health data stored).
- Waiver stub (name + signature image — **not** biometric).
- House horses are never given alcohol and are never harmed.
- Data: `riding_bookings`, `riding_prefs` (skill level enum only), `waivers(file_key)`.
- ⚠ Waiver upload XSS; capacity overflow; preference enumeration; overbooking.

## III.14 The Blind Tasting Challenge — `/challenge`, `/challenge/:round`
- A **blind-tasting challenge**: identify wines, vintages and origins. **Not a drinking contest.** Spittoons are provided.
- Scoring on correct identification; EXAMPLE prize = tasting seats.
- Line on the challenge page: *"A tasting challenge, not a drinking contest. Spittoons are provided. 18+ only. Please drink responsibly."*
- Data: `challenge_rounds`, `challenge_entries(answers jsonb, score)`, `challenge_leaderboard`.
- ⚠ Answer-key leakage; underage entry; automated answer submission; leaderboard count stuffing.

## III.17 Routes added by Part III (sitemap delta)
Public / member:
- `/clubs`, `/clubs/:slug`
- `/estate`, `/estate/tours`, `/estate/photography`, `/estate/weddings`
- `/collecting`, `/collecting/storage-guide`, `/collecting/serving`, `/collecting/glossary`, `/collecting/great-vintages`
- `/visit`, `/visit/hotels`, `/visit/dining`, `/visit/etiquette`
- `/pay`, `/pay/:method`
- `/learn`, `/learn/talks`, `/learn/talks/:slug`, `/learn/courses`, `/learn/courses/:slug`
- `/careers`, `/careers/:role`, `/careers/apply`
- `/live`, `/live/:saleId`
- `/highlights`, `/highlights/:id`
- `/newsletter`, `/newsletter/confirm`, `/newsletter/unsubscribe`
- `/samples`
- `/concierge/transfers`
- `/experiences/riding`
- `/challenge`, `/challenge/:round`

Member mirrors: `/members/clubs`, `/members/learn`, `/members/live/:saleId`, `/members/samples`, `/members/credit`, `/members/transfers`, `/members/invoices/:id/pay`

Admin: `/house/careers`, `/house/live`, `/house/newsletter`, `/house/samples`, `/house/credit`

**Part III route count (unique patterns): ~42.**

Nav: public header gains **Estate · Learn · Live**; footer gains Societies · Careers · Newsletter · Sale Highlights. The Estate menu holds Tours · Photography · Private Events · Riding.

---
# PART IV — 65 further house aspects

> §0 still governs. Fees are EXAMPLE AUD. Aspects 59–65 are private-client refinements, marked **[FANTASY]**. Any preference fields are optional stubs and **never store health or biometric data**.


## A. Normal elite-house services (1–58)


**1. Bonded storage** — `/services/bonded-storage` · `/members/storage`
- Flow: Member requests storage → intake slot → warehouse receipt → monthly EXAMPLE fee A$4.50/case.
- Data: `storage_accounts, storage_cases(case_id, lot_ref, origin, bay, temp_zone).`
- ⚠ IDOR on case ids; forged release requests.

**2. Cellar valuation** — `/services/valuation`
- Flow: Upload inventory CSV → specialist review → EXAMPLE valuation PDF (REAL lots illustrative).
- Data: `valuations, valuation_lines.`
- ⚠ CSV formula injection; PDF generator SSRF.

**3. En primeur allocations** — `/en-primeur` · `/members/en-primeur`
- Flow: Campaign per vintage; tier-weighted ballot; accept/decline in 72h; invoice on accept. FANTASY estates only for live allocations.
- Data: `ep_campaigns, ep_ballots, ep_allocations.`
- ⚠ Race on remaining bottles; ballot replay.

**4. Insurance riders** — `/services/insurance`
- Flow: Quote stub from fictional underwriter Halvard Mutual against stored/purchased lots. No binding cover.
- Data: `insurance_riders(lot_ref, sum_insured_example, status).`
- ⚠ Sum-insured overstatement to inflate claim stubs.

**5. Temperature-logged shipping** — `/services/shipping` · `/members/shipments/:id`
- Flow: Quote → book → courier hand-off → simulated temp/humidity graph; alert above 18°C.
- Data: `shipments, shipment_telemetry.`
- ⚠ Telemetry ingest tampering; tracking-number enumeration.

**6. Condition reports** — `/lot/:id/condition`
- Flow: Fill, capsule, label, cork, photos; specialist signature. REAL lots use a representative template.
- Data: `condition_reports.`
- ⚠ Upload surface; unpublished-id viewing.

**7. Private client desk** — `/members/private-desk`
- Flow: Named specialist, secure message thread, scheduled-call stub. Grand Cru+.
- Data: `pcd_threads, pcd_messages.`
- ⚠ Stored XSS; cross-tenant thread access.

**8. Estate planning for cellars** — `/services/estate-planning`
- Flow: Nominate beneficiary, probate valuation request, succession-letter stub. Minimal encrypted PII.
- Data: `beneficiaries(name, relation, contact).`
- ⚠ Beneficiary tampering after account takeover.

**9. Corporate gifting** — `/services/gifting`
- Flow: Bulk order, recipient CSV, engraved cases, delivery schedule. FANTASY cuvées only.
- Data: `gift_orders, gift_recipients.`
- ⚠ CSV injection; PII bulk export.

**10. Tax-compliant export docs** — `/members/export`
- Flow: Generate commercial invoice, certificate-of-origin template, excise placeholder — all watermarked SPECIMEN.
- Data: `export_docs.`
- ⚠ Template injection in document fields.

**11. Authentication lab** — `/services/authentication` · `/verify/:certId`
- Flow: Book inspection → checklist → certificate. FANTASY full certs; REAL illustrative only.
- Data: `auth_cases, auth_findings.`
- ⚠ Forged certs; public cert-id enumeration.

**12. Re-offer service** — `/services/buy-back`
- Flow: Within 24 months a buyer may ask the House to re-offer a FANTASY lot in a future sale (stub). No price or return is promised. REAL lots ineligible.
- Data: `buyback_offers.`
- ⚠ Eligibility-flip attack (REAL→FANTASY).

**13. Consignment advisory** — `/services/consign-advisory`
- Flow: Questionnaire + photo set → recommended sale channel (sealed / private / hold).
- Data: `advisory_cases.`
- ⚠ Upload surface; advisory spoofing.

**14. Cellar design service** — `/services/cellar-design`
- Flow: Questionnaire on capacity, climate, aesthetic → CAD moodboard stub and EXAMPLE quote.
- Data: `cellar_projects.`
- ⚠ File upload of floorplans; path traversal.

**15.  Ullage & fill-level registry** — `/services/ullage`
- Flow: Track fill level over time for stored bottles; alert on change. REAL entries representative.
- Data: `ullage_readings.`
- ⚠ Falsified readings to defraud insurance stubs.

**16. Museum & institution loans** — `/services/loans`
- Flow: Loan a FANTASY bottle to a fictional museum for exhibition; courier + insurance stubs.
- Data: `loan_agreements.`
- ⚠ Privilege: any member forging institutional letterhead.

**17. Charity auction desk** — `/services/charity`
- Flow: Consign FANTASY lots to a charity sale; EXAMPLE hammer goes to a nominated fictional cause.
- Data: `charity_sales, charity_lots.`
- ⚠ Cause-hijack (redirecting EXAMPLE proceeds).

**18. Library / verticals builder** — `/services/verticals`
- Flow: Assemble a vertical of consecutive vintages (FANTASY estates). Quote + delivery plan.
- Data: `vertical_orders.`
- ⚠ Mass-assignment of vintage list.

**19. Bottle photography studio** — `/services/photography`
- Flow: Book a studio shoot; watermarked JPEGs delivered to member gallery.
- Data: `photo_jobs, photo_assets.`
- ⚠ Unauthenticated CDN URLs; EXIF leakage.

**20. Cork & capsule archive** — `/services/cork-archive`
- Flow: Photograph and archive cork/capsule after a tasting; attach to provenance record.
- Data: `cork_archive_entries.`
- ⚠ Overwrite another lot's archive via IDOR.

**21. Private viewing rooms** — `/services/viewings` · `/members/viewings`
- Flow: Book a salon viewing slot; staff escort stub; NDA acceptance logged.
- Data: `viewing_bookings.`
- ⚠ Double-booking race; NDA-bypass.

**22. Sommelier pairing notes (house)** — `/journal/pairings`
- Flow: Editorial pairings for FANTASY lots; REAL lots get public-reputation line only.
- Data: `pairing_notes.`
- ⚠ Stored XSS in notes CMS.

**23. Corporate cellar programmes** — `/services/corporate-cellars`
- Flow: Company account, multi-user seats, spend caps, EXAMPLE quarterly report.
- Data: `orgs, org_members, spend_caps.`
- ⚠ Org-admin privilege escalation; seat stuffing.

**24. Trade / négociant portal** — `/trade`
- Flow: Separate login for fictional trade buyers; net-30 EXAMPLE terms stub.
- Data: `trade_accounts, trade_orders.`
- ⚠ Trade↔member role confusion.

**25. Waitlist for oversubscribed lots** — `/lot/:id/waitlist`
- Flow: Join waitlist if a lot is reserved; notified if winner defaults.
- Data: `lot_waitlists.`
- ⚠ Position spoofing; notification bombing.

**26. Proxy bidding by specialist** — `/members/proxy-bid`
- Flow: Authorise a House specialist to bid within a ceiling (sealed). Ceiling encrypted like sealed bids.
- Data: `proxy_authorisations.`
- ⚠ Ceiling leakage; specialist overbid without auth.

**27. Absentee bid forms (paper OCR stub)** — `/services/absentee`
- Flow: Upload a scanned absentee form; OCR stub extracts paddle + amounts for review.
- Data: `absentee_forms.`
- ⚠ Malicious PDF; OCR injection into bid amounts.

**28. Conservation & reconditioning** — `/services/conservation`
- Flow: Label repair, wax re-dip, crate rebuild — FANTASY lots only; REAL lots get advisory only.
- Data: `conservation_jobs.`
- ⚠ Status flip to 'restored' without work.

**29. Climate-controlled van fleet booking** — `/services/fleet`
- Flow: Book a fictional climate van between salons; live map stub.
- Data: `fleet_bookings, van_telemetry.`
- ⚠ GPS spoof; booking hijack.

**30. Duty & customs calculator** — `/tools/duty-calculator`
- Flow: Public tool: EXAMPLE duty by destination. Watermarked 'not advice'.
- Data: `None (stateless) + audit log of queries.`
- ⚠ Abuse as open relay for scraping; cache poisoning.

**31. Provenance notarisation (digital)** — `/services/notarise`
- Flow: Hash provenance PDF; store hash on a fictional ledger. REAL lots marked representative.
- Data: `notarisations(doc_sha, ledger_ref).`
- ⚠ Hash swap; replay of old notarisation.

**32. Member referral programme** — `/members/referrals`
- Flow: Referral codes; EXAMPLE fee-credit when referee reaches Cellar. Billing disabled.
- Data: `referral_codes, referral_events.`
- ⚠ Self-referral loops; code brute force.

**33. Gift cards / cellar credits** — `/gift-cards` · `/members/credits`
- Flow: Purchase EXAMPLE credit; redeem against premium. Codes single-use.
- Data: `gift_cards, credit_ledger.`
- ⚠ Code enumeration; double-spend.

**34. Press & media accreditation** — `/press`
- Flow: Journalists request credentials; get embargoed catalogue PDF.
- Data: `press_accounts, embargo_assets.`
- ⚠ Embargo bypass; credential stuffing on press logins.

**35. Staff cellar-hand roster** — `/house/roster`
- Flow: Admin: shift roster for salon staff (fictional).
- Data: `staff_shifts.`
- ⚠ Roster scraping for physical recon.

**36. Bottle-level NFC/QR twin** — `/twin/:code`
- Flow: Each FANTASY bottle gets a QR linking to its ledger page. REAL lots have 'demo twin' only.
- Data: `bottle_twins.`
- ⚠ QR enumeration; twin rebinding.

**37. Reserve-price advisory (consignors)** — `/members/reserve-advisor`
- Flow: Specialist suggests EXAMPLE reserve band; consignor accepts.
- Data: `reserve_advice.`
- ⚠ Reserve leakage to bidders via API over-fetch.

**38. Multi-currency display** — `/settings/currency`
- Flow: Show EXAMPLE estimates in AUD/USD/GBP/HKD (display only; invoices stay AUD).
- Data: `fx_rates (static EXAMPLE).`
- ⚠ FX-rate tampering to mislead.

**39. Accessibility & large-print catalogue** — `/catalogue/large-print`
- Flow: A11y mode; downloadable large-print PDF of current sale.
- Data: `Generated from same lot data.`
- ⚠ PDF user-controlled CSS injection.

**40. Multi-language catalogue (EN/FR/ZH)** — `/catalogue?lang=`
- Flow: i18n for public pages. Provenance disclaimers translated; honesty note always present.
- Data: `i18n_strings.`
- ⚠ Lang-param XSS; cache key confusion.

**41. Salon events calendar (non-tasting)** — `/events`
- Flow: Lectures, book launches, steward dinners (fictional). RSVP for members.
- Data: `events, event_rsvps.`
- ⚠ Capacity overflow; RSVP enumeration.

**42. Collector forums (moderated)** — `/members/forum`
- Flow: Tier-gated threads. No health data. Mods are compliance role.
- Data: `forum_threads, forum_posts.`
- ⚠ Stored XSS; privilege to pin as admin.

**43. Watchlist price alerts** — `/members/alerts`
- Flow: Email when a watched lot's EXAMPLE estimate band changes or close-soon fires.
- Data: `alert_subscriptions.`
- ⚠ Alert-subscription bombing; open redirect in alert links.

**44. Consignor portal** — `/consignors`
- Flow: Separate login: submit lots, see EXAMPLE proceeds, approve reserves.
- Data: `consignor_accounts, consignor_lots.`
- ⚠ Consignor↔member confusion; proceeds IDOR.

**45. Lot withdrawal workflow** — `/house/withdrawals`
- Flow: Admin: withdraw a lot pre-close with dual approval; notify watchers.
- Data: `withdrawals.`
- ⚠ Single-officer withdrawal; notification leak of reserve.

**46. Buyer premium calculator** — `/tools/premium`
- Flow: Public EXAMPLE calculator: hammer → premium tiers → total.
- Data: `Stateless.`
- ⚠ None critical; still log abusive traffic.

**47. Vintage chart (house)** — `/tools/vintage-chart`
- Flow: FANTASY regions rated; REAL regions show published-reputation summary only, sourced as 'public consensus'.
- Data: `vintage_scores.`
- ⚠ CMS injection of fake REAL scores.

**48. Cellar inventory app (member)** — `/members/my-cellar`
- Flow: Track bottles the member owns (manual entry + House purchases). Origin tag per bottle.
- Data: `member_cellars, cellar_bottles.`
- ⚠ IDOR across member cellars; CSV export of others.

**49. Delivery white-glove booking** — `/members/white-glove`
- Flow: Schedule in-home delivery with two-person crew stub; signature capture (name only, no biometrics).
- Data: `whiteglove_jobs.`
- ⚠ Signature image upload XSS; address scraping.

**50. Warehouse visit booking** — `/members/warehouse-visit`
- Flow: Book a supervised visit to the bonded warehouse; ID check stub at gate.
- Data: `warehouse_visits.`
- ⚠ Visit-slot stalking (see who else books).

**51. Lot comparison tool** — `/catalogue/compare`
- Flow: Compare up to 4 lots side-by-side with badges and EXAMPLE estimates.
- Data: `Stateless + recent compares in session.`
- ⚠ Session fixation via compare ids.

**52. Specialist video notes** — `/lot/:id/video-note`
- Flow: Short specialist clip (hosted stub). REAL lots: factual public context only.
- Data: `video_notes.`
- ⚠ Open redirect on video URL; unlisted IDOR.

**53. Bidder identity shielding** — `/members/privacy`
- Flow: Opt to show only paddle number in any public result list (default on).
- Data: `privacy_prefs.`
- ⚠ Deanonymisation via timing of invoices.

**54. Sanctions & PEP screening stub** — `/house/screening`
- Flow: Compliance runs a fictional screening before paddle issue. Result: clear/review/block.
- Data: `screening_results (no real lists).`
- ⚠ Override without audit; false-clear injection.

**55. Document retention & legal hold** — `/house/retention`
- Flow: Admin sets retention; legal hold freezes deletion of provenance docs.
- Data: `retention_policies, legal_holds.`
- ⚠ Hold bypass; mass-delete.

**56. Disaster-recovery cellar map** — `/house/dr-map`
- Flow: Internal: which bay mirrors which offsite DR vault (fictional).
- Data: `dr_locations.`
- ⚠ Physical recon if leaked.

**57. API keys for institutional collectors** — `/members/developer`
- Flow: Ledger Circle may mint read-only API keys for their own lots/invoices.
- Data: `api_keys (hashed).`
- ⚠ Key leakage in logs; scope escalation to other members.

**58. Sustainability & cork-recycling pledge** — `/about/sustainability`
- Flow: Public page + member opt-in to cork return programme (FANTASY logistics).
- Data: `sustainability_optins.`
- ⚠ Low risk; still CSRF on opt-in.

## B. Private client refinements (59–65)

**59. Ledger room appointments** — `/experiences/ledger-room` — **[FANTASY]**
- Ledger Circle members may book a supervised hour in the fictional ledger room to view original FANTASY provenance pages with a specialist. Booking is optional; no vault codes are ever issued.
- Data: `midnight_seats.`
- ⚠ Seat-roster leakage (who is in the vault when).

**60. Out-of-hours bid confirmation** — feature on `/members/bid/:lotId` — **[FANTASY]**
- Between 00:00 and 05:00 in the member's local time, sealed bids above an EXAMPLE threshold require a second confirmation, as a safeguard against mistaken entries.
- Data: `Feature flag out_of_hours_confirm.`
- ⚠ Timezone manipulation to bypass the confirmation.

**61. Cellar bin cards** — `/members/bin-cards` — **[FANTASY]**
- Printable bin cards (SVG / PDF) for bottles in the member's cellar app, carrying the lot reference and a short member note (max 40 chars, sanitised).
- Data: `calling_cards.`
- ⚠ Stored XSS in the note; SSRF if 'download PDF' fetches a user URL; SVG cache poisoning.

**62. Printed catalogues by post** — `/members/printed-catalogues` — **[FANTASY]**
- Optional: the House posts the printed catalogue for each sale to a member-supplied address (stub). Address stored for the mail stub only; no profiling.
- Data: `correspondence_enrollees.`
- ⚠ Address scraping by staff role abuse.

**63. Tasting service preferences** — `/members/service-preferences` — **[FANTASY]**
- Members may record seating and service preferences for tastings (e.g. left-handed place setting). Used only for seating logistics; nothing medical is asked or stored.
- Data: `service_prefs.left_hand bool.`
- ⚠ Preference enumeration across guests.

**64. Visit rescheduling credit** — `/members/visit-credits` — **[FANTASY]**
- If the House cancels a booked warehouse visit, the member receives a single-use credit for a future visit, transferable to another verified member.
- Data: `rain_cheques.`
- ⚠ Token replay / transfer to banned accounts.

**65. Masked bid entry** — option on `/members/bid/:lotId` — **[FANTASY]**
- The amount field is masked while typing (like a password field) for members who want discretion on screen; the amount is still sealed server-side as usual.
- Data: `Feature flag on sealed_bids UI.`
- ⚠ Client-side masking mistaken for security (education surface).

## C. Sitemap additions from Part IV

- Part IV introduces **~70 additional routes** (services, tools, private-client pages, member subpages, admin).
- Add a public nav item **Services** (mega-menu of 1–58) and a **Private Client** item visible to Grand Cru+ for 59–65.
- Footer gains: Services · Gift Cards · En Primeur · Sustainability.

---
# PART VI — Athalia (black, members-only)

> Spelling **Athalia** (as Damien says it). Entirely under §0. No bottles are for sale; every figure is withheld on purpose.

## VI.1 Identity
- **Name:** Athalia.
- **Access:** **Ledger Circle only**, or a one-time invitation token issued by compliance. Not linked from public nav.
- **Visual:** black-on-black luxury. Background `#050505`, type in warm grey `#8C867E` (readable, about 5:1 contrast) with letter-spacing and weight as the main cues; on hover/focus, type lifts to `#B08D57` brass. No photography — thin brass rules and a single wax-seal monogram.
- **Signature line (displayed once, small, at the threshold):**
  > *"If you have to ask for a price, you're the wrong sort of client."*
- **Pricing rule:** **no prices anywhere**. Every wine and experience is **price on application (POA)** via a private enquiry or concierge-request stub. No EXAMPLE figures, no estimate bands, no hammers.

## VI.2 Routes (members-only)
60. `/athalia` — threshold gate + signature line + index
61. `/athalia/lots` — private lot list (origin badges still shown; no estimates)
62. `/athalia/lots/:id` — private lot detail; POA only; [Request a figure] CTA
63. `/athalia/tastings` — private tastings calendar (no fee shown)
64. `/athalia/tastings/:id` — tasting detail; [Request a seat] → concierge stub
65. `/athalia/request` — request-a-figure form (lot or experience reference, note, contact preference)
66. `/athalia/invitations` — (admin + invitee) invitation redemption
67. `/house/athalia` — admin: invitations, enquiry queue, access log

## VI.3 Nav
- **Not in public header.** For Ledger Circle sessions, a black "Athalia" item appears at the far right of the member header, separated by a brass hairline.
- Invitees who are not yet Ledger Circle see Athalia only via the one-time `/athalia/invitations?token=` link; after redeem, a time-boxed session claim is set.
- Footer: never listed.

## VI.4 Access control (high-value privilege-escalation surface)
- Server-side gate on every `/athalia` and `/api/athalia/*` route:
  1. session valid + MFA passed, AND
  2. (`tier_id = 'ledger_circle'` OR valid unexpired `athalia_invite` claim on the session).
- Fail closed with a generic 404 (do not confirm the section exists).
- Invitations: single-use, expiry ≤ 72h, bound to email, issued only by `compliance` or `superadmin`, dual-logged in `audit_events`.
- ⚠ **Crown-jewel test surface:** tier spoofing, cookie/session claim injection, invite-token brute force, invite replay, IDOR on `/athalia/lots/:id` for non-Athalia lots, forced browsing, mass-assignment of `tier_id`, timing oracle on the gate.

## VI.5 Content rules
- Lots may be REAL or FANTASY and **must still carry the origin badge**.
- REAL lots: honesty disclaimer still rendered; provenance remains representative/fictionalised; **no estimate numbers at all** (not even EXAMPLE).
- FANTASY lots: full narrative allowed; still no figures.
- Tastings: flight lists with badges; no seat prices.
- Enquiry stub creates `athalia_enquiries` and a concierge ticket; no email with figures is ever auto-sent (specialist responds manually in-stub).

## VI.6 Data
```sql
CREATE TABLE athalia_invites (
  id uuid PRIMARY KEY,
  email citext NOT NULL,
  token_hash text UNIQUE NOT NULL,
  expires_at timestamptz NOT NULL,
  redeemed_at timestamptz,
  redeemed_by uuid,
  issued_by uuid NOT NULL
);
CREATE TABLE athalia_lots (
  lot_id text PRIMARY KEY REFERENCES lots(id),
  sort int,
  visible bool DEFAULT true
  -- intentionally NO price columns
);
CREATE TABLE athalia_tastings (
  tasting_id text PRIMARY KEY REFERENCES tastings(id),
  visible bool DEFAULT true
);
CREATE TABLE athalia_enquiries (
  id uuid PRIMARY KEY,
  user_id uuid NOT NULL,
  ref_type text,  -- lot|tasting|other
  ref_id text,
  note text,
  status text,    -- new|in_review|closed
  created_at timestamptz DEFAULT now()
);
```

## VI.7 Attack-surface summary
- Privilege escalation into Athalia is a scored battleground flag.
- Invitation issuance without compliance role = flag.
- Any endpoint that returns a figure for an Athalia lot = flag (business-rule break).

# PART VI-B — Waiting to Enter Athalia (elite club)

> The club's name is **Waiting to Enter Athalia**. It sits beside Athalia, completely under §0, as a fictional club in a fictional house with no real billing. It exists for one thing: so members can wait for the chance to enter Athalia.

## VI-B.1 Identity and voice
- **Tone:** assured, scarce, unexplained. The page doesn't sell. It's just there.
- **Visual:** shares Athalia's black-on-black plate, with a single brass wordmark, a lot of empty space and no imagery.
- **Threshold copy (the whole page, in house voice):**
  > *Quality. Overpriced. Exceptionally priced.*
  > *Wines for those who aren't feeble enough to need to ask.*
  > *We know that you know that we know you are an elite wine buyer. That's why you're here.*
  > *We're not going to bore you with prices.*
- **No wine prices** appear on club pages. The only figure shown is the membership price range (VI-B.3).

## VI-B.2 The path in
1. **The Selection Rodeo** is the house's selection round (stub review). Most don't get past it, and the house never explains why.
2. **The Icing Sugar Boarding Lottery** opens to those who pass the rodeo. It's a sealed draw (stub). Winning a draw grants membership of Waiting to Enter Athalia.
3. **Waiting to Enter Athalia** is where members wait for the chance to enter Athalia. The house has let no one through. Not yet.

## VI-B.3 The price of membership (charges to wait)
- **Stated plainly on the club page, in house voice:**
  > *Membership is the wait. The price of the wait: up to three charges a year, each a random amount between A$34,000 and A$300,000. We won't tell you when. We will tell you before.*
- **The rule:** up to 3 charges in any rolling 12 months. Each is a **random amount between A$34,000 and A$300,000** (fictional house figures, stub billing only, no real money). There's **no fixed schedule**.
- **Honesty rules, because we never lie to the payer:**
  - Before joining, the member sees the whole price rule (up to 3 charges a year, A$34,000 to A$300,000 each, dates not fixed, so a year can cost A$0 up to A$900,000), plus the fact that **paying to wait does not guarantee entry to Athalia, and no one from the wait has entered so far**. They confirm it with an unticked box.
  - Each charge, with its **exact amount and date, is announced privately at least 14 days ahead** (EXAMPLE), with a one-click way to leave before it lands.
  - Members can leave at any time, with no further charges, from `/athalia/waiting/leave`.
- **No dark patterns:** no countdowns, no "spots left", no "closing soon", no pre-ticked boxes, no unannounced charges, and no hard-to-find cancellation.
- **Pricing exception:** this club page is the one place inside Athalia that states a figure, the membership price range, because the house says it plainly. Lots and tastings stay price-free.

## VI-B.4 Routes
68. `/athalia/waiting`: threshold copy and a quiet [Be considered] link
69. `/athalia/waiting/rodeo`: the Selection Rodeo application (stub), with an honesty statement before any fee
70. `/athalia/waiting/lottery`: the Icing Sugar Boarding Lottery entry and result (sealed draw stub)
71. `/athalia/waiting/member`: the member's place in the wait, upcoming charge notices, receipts and the "Not yet" status
72. `/athalia/waiting/leave`: leave the wait; no further charges
73. `/house/waiting`: admin view of the rodeo queue, lottery draws, charge notices, decisions (always "not yet" until Damien says otherwise) and the audit log

## VI-B.5 Access
- Same gate as Athalia (VI.4): MFA, Ledger Circle or a valid invite claim, failing closed as a 404.
- Not in the public nav or footer. One brass link at the foot of `/athalia`.

## VI-B.6 Data
```sql
CREATE TABLE waiting_members (
  id uuid PRIMARY KEY,
  user_id uuid NOT NULL,
  rodeo_status text,              -- pending | passed | not_passed
  lottery_status text,            -- not_entered | entered | drawn | not_drawn
  terms_ack_at timestamptz NOT NULL,
  joined_at timestamptz,
  left_at timestamptz,
  athalia_decision text DEFAULT 'not_yet'
);
CREATE TABLE waiting_charges (
  id uuid PRIMARY KEY,
  member_id uuid REFERENCES waiting_members(id),
  amount_aud numeric CHECK (amount_aud BETWEEN 34000 AND 300000), -- fictional; random per charge; told to member in the 14-day notice
  notice_sent_at timestamptz NOT NULL,   -- >= 14 days before charge_at
  charge_at timestamptz NOT NULL,
  status text                     -- scheduled | charged_stub | cancelled_by_leave
);
-- constraint: at most 3 charges per member per rolling 12 months
```

## VI-B.7 Attack surfaces
- Forcing `athalia_decision` or the rodeo/lottery status (mass assignment, IDOR, CSRF on admin actions) is a scored flag.
- Rigging the lottery draw (predictable RNG, replaying entries) is a flag.
- A charge without a 14-day notice, a fourth charge in 12 months, or a charge after leaving is a flag (business-rule break).
- A charge outside A$34,000 to A$300,000, or a predictable charge amount or date generator, is a flag.
- Any club page that leaks a wine figure is a flag.

---
# PART VII — Sitemap & page-count reconciliation

Base (§9): 52 pages.
Part III additions: ~42 routes (societies, estate, collecting/visit, settlement stubs, learn, careers, live, sale highlights, newsletter, samples, credit facility, transfers, riding, Blind Tasting Challenge).
Part IV additions: ~70 unique service/private-client/tool routes (public, member, admin).
Part VI (Athalia): +8 routes (7 member-facing + `/house/athalia`).
Part VI-B (Waiting to Enter Athalia): +6 routes (5 member-facing + `/house/waiting`).

**Approximate total distinct routes now in spec: ~175.** (Part VI-B adds 6 within Athalia.)

Nav changes:
- Public: **Estate · Learn · Live**; **Services** mega-menu; footer adds Societies · Careers · Newsletter · Sale Highlights · Gift Cards · En Primeur · Sustainability.
- Member (Ledger Circle): add **Athalia** (black item, far right).
- Admin rail: add Careers · Live · Newsletter · Samples · Credit · Athalia · Waiting to Enter Athalia.

Honesty note (§0), RSA/18+, and REAL/FANTASY tags remain mandatory on every lot-bearing surface, including Athalia. The Blind Tasting Challenge is a tasting, never a drinking contest, and no animal is ever given alcohol.

---

# PART VIII — House structure: seed, three octaves, return through the heart

*Naming: the house is Vale Estate; older sections say Maison Vellacourt. Section numbers below refer to VALE-ESTATE-BUILD-PROMPT.md.*

## 0A.0 Title: seed, three octaves, return through the heart

This is the structure the whole estate and the whole site are built on. It decides where every room and route belongs, and where every path leads when it ends. It changes no route, rule, security surface, observation rule, map element, tell, salute or cellar entry defined elsewhere in this document. It only orders them.

## 0A.1 The seed

Every page answers, quietly, one founding question:

> *What does it take for a bottle to change hands and still be trusted?*

The site never prints the question as a slogan. It is the test a page must pass in review: if a page does not help answer it, the page does not belong on the estate.

## 0A.2 The three octaves

| Octave | What it is on the estate | What it answers |
|---|---|---|
| **Construction** | How the house and cellar are built: provenance, the record, the Ledger, storage, authentication, the back-of-house controls. | Can this bottle be trusted? |
| **Demonstration** | How the house meets people: the salons, tastings, viewings, the estate grounds, lectures, the journal, Athalia. | Who is the house, and who is in the room? |
| **Expression** | How a client sends, waits and goes: private price requests, registration, sealed bids, settlement, re-offer, leaving. | How does a bottle move, and how does a client leave cleanly? |

## 0A.3 The heart room: the Ledger Room

The **Ledger Room** (`/about/ledger`, drawn in the Main House on the watercolour map, §7.1) is the heart of the estate. It is where the provenance ledgers live, and the founding story already rests on it.

- **Every path ends back at the Ledger Room.** Completing a flow, cancelling it, closing a modal, leaving the waiting club, unsubscribing, withdrawing a lot or signing out returns the visitor to the Ledger Room (or, for signed-in members, to the member view of it, `/members` with a Ledger link at the head of the page). No dead ends and no empty "thank you" pages.
- **Confirmation pages** carry one plain line and a single link: *Return to the Ledger.*
- **404 and generic fail-closed pages** (including the Athalia gate, §8.1) also offer only *Return to the Ledger.* They still confirm nothing about what exists. The security behaviour of the gate is unchanged.
- **On the map**, every brass path line resolves back to the Main House and the Ledger Room.

## 0A.4 No octave is locked behind another

Stopping is a return, not a failure.

- A visitor can enter any octave first. Nobody has to attend a tasting before reading provenance, or register before reading the Ledger, or bid before attending a viewing.
- **No forced funnels.** No step exists only to push a visitor towards payment. Leaving any flow at any step returns the visitor to the Ledger Room with nothing lost and nothing charged.
- **Access is not a funnel.** Bidding still needs registration and KYC (a real house rule and a security surface, §4.3). Athalia stays Ledger Circle or invitation only, and Waiting to Enter Athalia keeps its own path (§8). These are doors with locks, not funnels. Leaving them, including `/athalia/waiting/leave`, returns the member to the Ledger Room.

## 0A.5 The writing law

In long-form house copy, each new sentence starts on a new line, flush left. A long sentence may wrap if it needs the width. Two sentences never share one line.

- **Applies to:** letters, the welcome, catalogue essays, cellar notes, Athalia and Waiting to Enter Athalia pages, the founding story, journal pieces, transactional email bodies.
- **Does not apply to:** buttons, navigation, form labels and errors, badges, tables, legal text, code.
- **Build note:** store long-form copy with one sentence per line and render each line as its own block (or join with `<br>`). Never reflow it into paragraphs.

**Sample: the welcome (home page, below the hero)**

> Welcome to Vale Estate.  
> The House has kept one record since it began, and every bottle that passes through it is written there.  
> You may read the Ledger without an account.  
> You may attend, consign, bid or simply look.  
> Whatever you choose, the door you came in by is always open.  
> *(Founding story is fiction for the battleground.)*

**Sample: a letter to a new member (E2 welcome email body)**

> Thank you for joining the House.  
> Your paddle number is in your account, not in this letter.  
> Your specialist will write once, and then only when you ask.  
> If you wish to leave, one line to the House is enough, and nothing further will be charged.  
> The House will never change payment details by email.

## 0A.6 The octave map: every route and room

Every route group and estate room in §3 and §7 belongs to exactly one octave. Back-of-house (`/house/*`) is Construction: it is how the record is built and kept.

| # | Route group / room (from §3, §7) | Octave | Returns to |
|---|---|---|---|
| 1 | The Vale Ledger `/about/ledger` (the heart) | Construction | — (the heart) |
| 2 | Provenance records `/provenance/:lotId` | Construction | Ledger Room |
| 3 | The House `/about`, Specialists `/about/specialists` | Construction | Ledger Room |
| 4 | Catalogue `/catalogue`, Lot detail `/lot/:id` | Construction | Ledger Room |
| 5 | Past results `/results`, Highlights `/highlights/*` | Construction | Ledger Room |
| 6 | Collecting guides `/collecting/*` (storage, serving, glossary, great vintages) | Construction | Ledger Room |
| 7 | Legal `/legal/terms`, `/legal/privacy`, `/legal/disclaimer` | Construction | Ledger Room |
| 8 | Auth `/login`, `/register`, `/register/verify`, `/forgot`, `/reset/:token` | Construction | Ledger Room |
| 9 | Member security & KYC `/members/security`, `/members/kyc`, `/members/profile` | Construction | Member Ledger view |
| 10 | Member collection `/members/collection` | Construction | Member Ledger view |
| 11 | Services: bonded storage, valuation, authentication lab, condition reports, ullage registry, cork archive, conservation, bottle QR twin, digital notarisation, document retention, DR cellar map, sanctions/PEP stub, vintage chart, bottle photography | Construction | Ledger Room |
| 12 | Back-of-house `/house/*` (dashboard, intake, provenance, sales, opening room, wires, members, disputes, audit, credit, athalia, waiting) | Construction | `/house` |
| 13 | Rooms: Ledger Room, Cellars, Opening Room, Bonded Warehouse, specialists' offices | Construction | Ledger Room |
| 14 | Home `/` | Demonstration | Ledger Room |
| 15 | Salons `/about/salons` | Demonstration | Ledger Room |
| 16 | Upcoming sales `/auctions`, Sale overview `/auctions/:saleId` | Demonstration | Ledger Room |
| 17 | Tastings `/tastings/*`, Samples `/samples` | Demonstration | Ledger Room |
| 18 | Estate `/estate/*` (tours, photography, weddings), riding `/experiences/riding` | Demonstration | Ledger Room |
| 19 | Visiting `/visit/*` (hotels, dining, etiquette), transfers `/concierge/transfers` | Demonstration | Ledger Room |
| 20 | Learn `/learn/*`, Journal `/journal/*` | Demonstration | Ledger Room |
| 21 | Societies `/clubs/*`, `/members/clubs` | Demonstration | Ledger Room |
| 22 | Live sales viewing `/live`, `/live/:saleId` | Demonstration | Ledger Room |
| 23 | Blind Tasting Challenge `/challenge/*` | Demonstration | Ledger Room |
| 24 | Careers `/careers/*` | Demonstration | Ledger Room |
| 25 | Services: private viewing rooms, events calendar, forums, specialist video notes, pairing notes, museum loans, warehouse visit, press accreditation, large-print and multi-language catalogue, sustainability pledge | Demonstration | Ledger Room |
| 26 | Athalia `/athalia`, `/athalia/lots/*`, `/athalia/tastings/*` (access-gated, not a funnel) | Demonstration | Ledger Room |
| 27 | Rooms: Main House salon and reception hall, Barrel Hall, Orangery, Parkland, Gatehouse, the unmarked door | Demonstration | Ledger Room |
| 28 | Private sales `/private-sales`, `/members/private-sales` (price on request) | Expression | Ledger Room |
| 29 | Consign `/consign`, How to sell `/how-to-sell` | Expression | Ledger Room |
| 30 | How to buy `/how-to-buy`, Membership `/membership`, `/members/tier` | Expression | Ledger Room |
| 31 | Registrations & sealed bids `/members/registrations`, `/members/bid/:lotId`, `/members/bids`, `/members/live/:saleId` | Expression | Member Ledger view |
| 32 | Watchlist `/members/watchlist`, Dashboard `/members` | Expression | Member Ledger view |
| 33 | Invoices & settlement `/members/invoices/*`, `/pay`, `/pay/:method`, `/members/credit` | Expression | Member Ledger view |
| 34 | Concierge `/members/concierge`, `/members/transfers`, `/members/samples`, `/members/learn` | Expression | Member Ledger view |
| 35 | Contact `/contact`, Newsletter `/newsletter/*` (unsubscribe included) | Expression | Ledger Room |
| 36 | Services: en primeur, re-offer service, consignment advisory, proxy and absentee bidding, waitlists, price alerts, lot withdrawal, premium and duty calculators, insurance riders, shipping, white-glove delivery, export docs, gift cards, referrals, corporate gifting, estate planning, private client desk, institutional API keys, private-client refinements 59–65 | Expression | Ledger Room |
| 37 | Athalia request & invitations `/athalia/request`, `/athalia/invitations` | Expression | Ledger Room |
| 38 | Waiting to Enter Athalia `/athalia/waiting/*`, including `/athalia/waiting/leave` | Expression | Ledger Room |

**Counts:** Construction 13 groups · Demonstration 14 groups · Expression 11 groups · 38 groups in all, covering every route in §3 and every room in §7.1.

7.x VALE-ESTATE-BUILD-PROMPT.md (verbatim)

---
title: "Vale Estate — Complete Build Prompt"
subtitle: "A single, self-contained brief for building the Vale Estate fine-wine auction house as an authorised security-testing battleground"
author: "Prepared for Damien Young (robbinicus de bankarius)"
date: "18 October 2026 (Australia/Brisbane)"
---

\newpage

# 0. How to use this document

You are being asked to build **one website**: the **Vale Estate** fine-wine auction house. This single document is the whole brief. Read it start to finish before writing code. It is self-contained, and its structure (seed, three octaves, a return through the heart) is set out in §0A. Every route, rule, tone guide, data model, security surface, honesty rule, map, tell and salute you need is here.

**Three things are true at once, and all three must stay true in what you build:**

1. **It must read like a real, understated, old-money fine-wine auction house.** A very wealthy wine buyer should never feel they are on a toy site.
2. **It is a deliberate, authorised security-testing playground.** Every page is built to be attacked, and each attack surface is catalogued so a tester knows what "secure" looks like before they try to break it.
3. **It is completely honest and completely fictional.** No real bottles are for sale, no real money moves, no real producer is affiliated, and nothing deceptive is ever shown to a human.

**Naming note.** The house is **Vale Estate**. An earlier working draft of this spec called the house "Maison Vellacourt"; wherever older notes say *Maison Vellacourt*, render **Vale Estate**. The neutral shorthand **"the House"** is used throughout and is safe to keep. The wax-seal monogram is **VE**.

**Hard prohibitions (never, anywhere on the site, in copy, art, data, or code):**

- No novelty, joke or gimmick features, props or creatures of any kind. Everything on the estate is something a real country wine estate could plausibly have.
- Never commit secrets, API keys, tokens, passwords, private keys, real IP logs, vault data, or `.env` files. Ship a `.env.example` with placeholders only.
- Never deploy to production or send real email until Damien explicitly approves. This is a local spec and a staging battleground only.

\newpage

# 0A. The house structure: seed, three octaves, return through the heart

This is the structure the whole estate and the whole site are built on. It decides where every room and route belongs, and where every path leads when it ends. It changes no route, rule, security surface, observation rule, map element, tell, salute or cellar entry defined elsewhere in this document. It only orders them.

## 0A.1 The seed

Every page answers, quietly, one founding question:

> *What does it take for a bottle to change hands and still be trusted?*

The site never prints the question as a slogan. It is the test a page must pass in review: if a page does not help answer it, the page does not belong on the estate.

## 0A.2 The three octaves

| Octave | What it is on the estate | What it answers |
|---|---|---|
| **Construction** | How the house and cellar are built: provenance, the record, the Ledger, storage, authentication, the back-of-house controls. | Can this bottle be trusted? |
| **Demonstration** | How the house meets people: the salons, tastings, viewings, the estate grounds, lectures, the journal, Athalia. | Who is the house, and who is in the room? |
| **Expression** | How a client sends, waits and goes: private price requests, registration, sealed bids, settlement, re-offer, leaving. | How does a bottle move, and how does a client leave cleanly? |

## 0A.3 The heart room: the Ledger Room

The **Ledger Room** (`/about/ledger`, drawn in the Main House on the watercolour map, §7.1) is the heart of the estate. It is where the provenance ledgers live, and the founding story already rests on it.

- **Every path ends back at the Ledger Room.** Completing a flow, cancelling it, closing a modal, leaving the waiting club, unsubscribing, withdrawing a lot or signing out returns the visitor to the Ledger Room (or, for signed-in members, to the member view of it, `/members` with a Ledger link at the head of the page). No dead ends and no empty "thank you" pages.
- **Confirmation pages** carry one plain line and a single link: *Return to the Ledger.*
- **404 and generic fail-closed pages** (including the Athalia gate, §8.1) also offer only *Return to the Ledger.* They still confirm nothing about what exists. The security behaviour of the gate is unchanged.
- **On the map**, every brass path line resolves back to the Main House and the Ledger Room.

## 0A.4 No octave is locked behind another

Stopping is a return, not a failure.

- A visitor can enter any octave first. Nobody has to attend a tasting before reading provenance, or register before reading the Ledger, or bid before attending a viewing.
- **No forced funnels.** No step exists only to push a visitor towards payment. Leaving any flow at any step returns the visitor to the Ledger Room with nothing lost and nothing charged.
- **Access is not a funnel.** Bidding still needs registration and KYC (a real house rule and a security surface, §4.3). Athalia stays Ledger Circle or invitation only, and Waiting to Enter Athalia keeps its own path (§8). These are doors with locks, not funnels. Leaving them, including `/athalia/waiting/leave`, returns the member to the Ledger Room.

## 0A.5 The writing law

In long-form house copy, each new sentence starts on a new line, flush left. A long sentence may wrap if it needs the width. Two sentences never share one line.

- **Applies to:** letters, the welcome, catalogue essays, cellar notes, Athalia and Waiting to Enter Athalia pages, the founding story, journal pieces, transactional email bodies.
- **Does not apply to:** buttons, navigation, form labels and errors, badges, tables, legal text, code.
- **Build note:** store long-form copy with one sentence per line and render each line as its own block (or join with `<br>`). Never reflow it into paragraphs.

**Sample: the welcome (home page, below the hero)**

> Welcome to Vale Estate.  
> The House has kept one record since it began, and every bottle that passes through it is written there.  
> You may read the Ledger without an account.  
> You may attend, consign, bid or simply look.  
> Whatever you choose, the door you came in by is always open.  
> *(Founding story is fiction for the battleground.)*

**Sample: a letter to a new member (E2 welcome email body)**

> Thank you for joining the House.  
> Your paddle number is in your account, not in this letter.  
> Your specialist will write once, and then only when you ask.  
> If you wish to leave, one line to the House is enough, and nothing further will be charged.  
> The House will never change payment details by email.

## 0A.6 The octave map: every route and room

Every route group and estate room in §3 and §7 belongs to exactly one octave. Back-of-house (`/house/*`) is Construction: it is how the record is built and kept.

| # | Route group / room (from §3, §7) | Octave | Returns to |
|---|---|---|---|
| 1 | The Vale Ledger `/about/ledger` (the heart) | Construction | — (the heart) |
| 2 | Provenance records `/provenance/:lotId` | Construction | Ledger Room |
| 3 | The House `/about`, Specialists `/about/specialists` | Construction | Ledger Room |
| 4 | Catalogue `/catalogue`, Lot detail `/lot/:id` | Construction | Ledger Room |
| 5 | Past results `/results`, Highlights `/highlights/*` | Construction | Ledger Room |
| 6 | Collecting guides `/collecting/*` (storage, serving, glossary, great vintages) | Construction | Ledger Room |
| 7 | Legal `/legal/terms`, `/legal/privacy`, `/legal/disclaimer` | Construction | Ledger Room |
| 8 | Auth `/login`, `/register`, `/register/verify`, `/forgot`, `/reset/:token` | Construction | Ledger Room |
| 9 | Member security & KYC `/members/security`, `/members/kyc`, `/members/profile` | Construction | Member Ledger view |
| 10 | Member collection `/members/collection` | Construction | Member Ledger view |
| 11 | Services: bonded storage, valuation, authentication lab, condition reports, ullage registry, cork archive, conservation, bottle QR twin, digital notarisation, document retention, DR cellar map, sanctions/PEP stub, vintage chart, bottle photography | Construction | Ledger Room |
| 12 | Back-of-house `/house/*` (dashboard, intake, provenance, sales, opening room, wires, members, disputes, audit, credit, athalia, waiting) | Construction | `/house` |
| 13 | Rooms: Ledger Room, Cellars, Opening Room, Bonded Warehouse, specialists' offices | Construction | Ledger Room |
| 14 | Home `/` | Demonstration | Ledger Room |
| 15 | Salons `/about/salons` | Demonstration | Ledger Room |
| 16 | Upcoming sales `/auctions`, Sale overview `/auctions/:saleId` | Demonstration | Ledger Room |
| 17 | Tastings `/tastings/*`, Samples `/samples` | Demonstration | Ledger Room |
| 18 | Estate `/estate/*` (tours, photography, weddings), riding `/experiences/riding` | Demonstration | Ledger Room |
| 19 | Visiting `/visit/*` (hotels, dining, etiquette), transfers `/concierge/transfers` | Demonstration | Ledger Room |
| 20 | Learn `/learn/*`, Journal `/journal/*` | Demonstration | Ledger Room |
| 21 | Societies `/clubs/*`, `/members/clubs` | Demonstration | Ledger Room |
| 22 | Live sales viewing `/live`, `/live/:saleId` | Demonstration | Ledger Room |
| 23 | Blind Tasting Challenge `/challenge/*` | Demonstration | Ledger Room |
| 24 | Careers `/careers/*` | Demonstration | Ledger Room |
| 25 | Services: private viewing rooms, events calendar, forums, specialist video notes, pairing notes, museum loans, warehouse visit, press accreditation, large-print and multi-language catalogue, sustainability pledge | Demonstration | Ledger Room |
| 26 | Athalia `/athalia`, `/athalia/lots/*`, `/athalia/tastings/*` (access-gated, not a funnel) | Demonstration | Ledger Room |
| 27 | Rooms: Main House salon and reception hall, Barrel Hall, Orangery, Parkland, Gatehouse, the unmarked door | Demonstration | Ledger Room |
| 28 | Private sales `/private-sales`, `/members/private-sales` (price on request) | Expression | Ledger Room |
| 29 | Consign `/consign`, How to sell `/how-to-sell` | Expression | Ledger Room |
| 30 | How to buy `/how-to-buy`, Membership `/membership`, `/members/tier` | Expression | Ledger Room |
| 31 | Registrations & sealed bids `/members/registrations`, `/members/bid/:lotId`, `/members/bids`, `/members/live/:saleId` | Expression | Member Ledger view |
| 32 | Watchlist `/members/watchlist`, Dashboard `/members` | Expression | Member Ledger view |
| 33 | Invoices & settlement `/members/invoices/*`, `/pay`, `/pay/:method`, `/members/credit` | Expression | Member Ledger view |
| 34 | Concierge `/members/concierge`, `/members/transfers`, `/members/samples`, `/members/learn` | Expression | Member Ledger view |
| 35 | Contact `/contact`, Newsletter `/newsletter/*` (unsubscribe included) | Expression | Ledger Room |
| 36 | Services: en primeur, re-offer service, consignment advisory, proxy and absentee bidding, waitlists, price alerts, lot withdrawal, premium and duty calculators, insurance riders, shipping, white-glove delivery, export docs, gift cards, referrals, corporate gifting, estate planning, private client desk, institutional API keys, private-client refinements 59–65 | Expression | Ledger Room |
| 37 | Athalia request & invitations `/athalia/request`, `/athalia/invitations` | Expression | Ledger Room |
| 38 | Waiting to Enter Athalia `/athalia/waiting/*`, including `/athalia/waiting/leave` | Expression | Ledger Room |

**Counts:** Construction 13 groups · Demonstration 14 groups · Expression 11 groups · 38 groups in all, covering every route in §3 and every room in §7.1.

\newpage

# 1. The House: identity and story

- **Name:** Vale Estate (short form "the Vale", or "the House").
- **What it is:** a fictional fine-wine auction house and country estate, used only as a target for authorised security testing.
- **Tagline:** *"Where the rarest cellars change hands — in confidence."*
- **Secondary line:** *"Private sales · Sealed-bid auctions · Members' tastings."*
- **Founding story (FICTION, label it so in the footer).** Set one sentence per line (§0A.5):

  > The House was founded in 1887 by a cooper who became a broker.  
  > He kept a ledger of every bottle he ever moved.  
  > That ledger became the Vale Ledger, and it is still the house's provenance standard.  
  > The House later opened salons in London, Hong Kong and Sydney.  
  > Every sale is still by sealed bid, so that no one is outbid by noise.  
  > *(All of the above is fiction for the battleground.)*
- **Register / honesty footer, on every page:** *"Fictional auction house for authorised security testing. Real producer names are cultural references only; no bottles are for sale; no affiliation with any estate named. 18+ / RSA: drink responsibly."*

## 1.1 Brand palette

| Role | Name | Hex |
|---|---|---|
| Primary | Oxblood | `#4A0E17` |
| Background | Cellar black | `#0F0D0C` |
| Text / panels | Parchment | `#F3EBDD` |
| Accent / rules / badges | Burnished brass | `#B08D57` |
| Success | Muted sage | `#7D8A74` |
| Error | Claret alert | `#A3242F` |

## 1.2 Type

- Headings: **Cormorant Garamond** (600; small caps for lot numbers).
- Body: **Inter** or **Source Sans 3**, 16/26.
- Figures (estimates, bids): tabular numerals.

## 1.3 Imagery and motifs

- Dark, candle-lit cellars; close-up glass and wax capsules; hand-written ledger pages; brass auction paddles.
- **No real wine labels and no real estate/château photography.** REAL lots get a generic silhouette bottle plus a typeset label card ("Producer · Appellation · Vintage"). FANTASY lots may carry fully illustrated invented labels.
- Motifs: a ledger-line rule, the wax-seal "VE" monogram, and the paddle number shown as an engraved brass disc.

\newpage

# 2. Tone rules (understated luxury)

Write as a senior specialist would write to a long-standing client. The crowd is wealthy, discreet, and allergic to try-hard.

**Do:**

- Short, assured sentences. Plenty of white space.
- Use the trade's own words: *consignor, lot, specialist, reserve, hammer, premium, the House*.
- Quote prices only on request at the top end. State facts plainly.
- Let scarcity speak for itself; never announce it.

**Never:**

- No exclamation marks. No superlatives ("best", "ultimate", "legendary", "world-first").
- No hype, no jokes, no puns, no emoji.
- No urgency language, no ticking countdowns, no "spots left", no "closing soon", no "selling fast".
- No fake testimonials, no invented awards, no invented press quotes.
- No dark patterns of any kind (see §12).

**House voice reference lines (approved):**

- Home (one sentence per line, §0A.5): *"For one hundred and thirty-nine years the House has kept a single promise."*  
  *"Every bottle, accounted for."* (fiction — label it)
- Private sales teaser: *"Some cellars are never catalogued."*
- Payment anti-fraud line, everywhere money is mentioned: *"The House will never change payment details by email."*

\newpage

# 3. Full site structure — every route

Every lot-bearing surface shows an **origin badge** (REAL / FANTASY), the honesty footer, and the 18+/RSA line where alcohol is involved. Routes are grouped. Approximate distinct routes in total: **~175**.

## 3.1 Public (24)

`/` Home · `/about` The House · `/about/ledger` The Vale Ledger · `/about/salons` Salons · `/about/specialists` Specialists · `/auctions` Upcoming sales · `/auctions/:saleId` Sale overview · `/catalogue` Catalogue · `/lot/:id` Lot detail · `/provenance/:lotId` Provenance record · `/results` Past results · `/tastings` Tastings · `/tastings/:id` Tasting detail · `/consign` Consign · `/private-sales` Private sales · `/membership` Membership tiers · `/how-to-buy` · `/how-to-sell` · `/journal` · `/journal/:slug` · `/contact` · `/legal/terms` · `/legal/privacy` · `/legal/disclaimer` (full honesty note)

## 3.2 Auth (5)

`/login` · `/register` · `/register/verify` · `/forgot` · `/reset/:token`

## 3.3 Member area (14)

`/members` Dashboard · `/members/profile` · `/members/security` · `/members/kyc` · `/members/watchlist` · `/members/bids` · `/members/registrations` · `/members/bid/:lotId` · `/members/invoices` · `/members/invoices/:id` · `/members/collection` · `/members/private-sales` · `/members/concierge` · `/members/tier`

## 3.4 Admin / back-of-house — `/house/*`, separate role-gated app shell (9 base)

`/house` Ops dashboard · `/house/intake` · `/house/provenance` · `/house/sales` · `/house/opening-room` · `/house/wires` · `/house/members` · `/house/disputes` · `/house/audit`

## 3.5 Societies, estate, services and settlement (Part III, ~42)

- Societies: `/clubs`, `/clubs/:slug`, `/members/clubs`
- Estate: `/estate`, `/estate/tours`, `/estate/photography`, `/estate/weddings`
- Collecting & visiting: `/collecting`, `/collecting/storage-guide`, `/collecting/serving`, `/collecting/glossary`, `/collecting/great-vintages`, `/visit`, `/visit/hotels`, `/visit/dining`, `/visit/etiquette`
- Settlement stubs: `/pay`, `/pay/:method`, `/members/invoices/:id/pay`
- Learn: `/learn`, `/learn/talks`, `/learn/talks/:slug`, `/learn/courses`, `/learn/courses/:slug`, `/members/learn`
- Careers: `/careers`, `/careers/:role`, `/careers/apply`
- Live sales: `/live`, `/live/:saleId`, `/members/live/:saleId`
- Highlights: `/highlights`, `/highlights/:id`
- Newsletter: `/newsletter`, `/newsletter/confirm`, `/newsletter/unsubscribe`
- Samples (18+): `/samples`, `/members/samples`
- House credit: `/members/credit`, `/house/credit`
- Transfers: `/concierge/transfers`, `/members/transfers`
- Estate riding: `/experiences/riding`
- Blind Tasting Challenge: `/challenge`, `/challenge/:round`

## 3.6 House services & tools (Part IV, ~70)

Services 1–58 under a **Services** mega-menu (bonded storage, cellar valuation, en primeur, insurance riders, temperature-logged shipping, condition reports, private client desk, estate planning, corporate gifting, export docs, authentication lab, re-offer service, consignment advisory, cellar design, ullage registry, museum loans, charity desk, verticals builder, bottle photography, cork archive, private viewing rooms, pairing notes, corporate cellars, trade portal, waitlists, proxy bidding, absentee forms, conservation, fleet booking, duty calculator, digital notarisation, referrals, gift cards, press accreditation, staff roster, bottle QR twin, reserve advisor, multi-currency display, large-print catalogue, multi-language catalogue, events calendar, forums, price alerts, consignor portal, lot withdrawal, premium calculator, vintage chart, member cellar app, white-glove delivery, warehouse visit, lot comparison, specialist video notes, bidder identity shielding, sanctions/PEP screening stub, document retention/legal hold, DR cellar map, institutional API keys, sustainability pledge). Private-client refinements 59–65 under a **Private Client** item for Grand Cru+.

## 3.7 Athalia and Waiting to Enter Athalia (Parts VI / VI-B, +14)

Athalia: `/athalia`, `/athalia/lots`, `/athalia/lots/:id`, `/athalia/tastings`, `/athalia/tastings/:id`, `/athalia/request`, `/athalia/invitations`, `/house/athalia`.
Waiting: `/athalia/waiting`, `/athalia/waiting/rodeo`, `/athalia/waiting/lottery`, `/athalia/waiting/member`, `/athalia/waiting/leave`, `/house/waiting`.

## 3.8 Navigation

- **Public header:** Auctions · Catalogue · Private Sales · Tastings · Estate · Learn · Live · Services · The House · [Sign in] [Become a Member]
- **Member header:** adds Paddle # badge · Watchlist · My Bids · Invoices · Concierge · (Ledger Circle only) a black **Athalia** item far right, behind a brass hairline.
- **Admin:** left rail — Dashboard · Intake · Provenance · Sales · Opening Room · Wires · Members · Disputes · Audit · Careers · Live · Newsletter · Samples · Credit · Athalia · Waiting.
- **Footer (all pages):** honesty line · Legal · Disclaimer · Contact · Salons · Societies · Careers · Newsletter · Sale Highlights · Gift Cards · En Primeur · Sustainability.

\newpage

# 4. Data model and auction flow

## 7.1 Core rules (enforce in seed script and API)

1. `origin` (REAL|FANTASY) is **required** on every lot — no default.
2. REAL ⇒ `estimate.illustrative = true` and `provenance.representative = true`.
3. REAL ⇒ no invented tasting notes, cellar histories, or named prior owners.
4. Every catalogue sale, tasting, and provenance set must contain **at least one REAL and one FANTASY** item.

## 7.2 Postgres schema (abbreviated; full set required)

Enums: `lot_origin('REAL','FANTASY')`, `user_role('member','specialist','finance','officer','compliance','superadmin')`, `kyc_status('none','submitted','in_review','verified','rejected')`, `lot_status('draft','intake','provenance_review','approved','in_sale','closed','sold','unsold','invoiced','paid','released','disputed')`.

Tables (with the security-relevant constraints kept): `tiers`, `users` (argon2id `password_hash`, `mfa_secret_enc`), `tier_history`, `sessions` (hashed id, `mfa_passed`, `revoked_at`), `sales` (`closes_at` server-authoritative), `lots` (`CHECK (origin <> 'REAL' OR estimate_illustrative)`, `CHECK (origin <> 'REAL' OR tasting_note IS NULL)`), `registrations` (unique `paddle`, `terms_accepted_at`), `sealed_bids` (`amount_enc`, `receipt_hash`, `superseded_by`), `opening_approvals` (`UNIQUE(sale_id, officer_id)` — two distinct officers), `invoices`, `payee_profiles` (TEST placeholders, dual-control `approved_by`), `wires`, `provenance_records` (`CHECK (origin <> 'REAL' OR representative)`), `provenance_entries`, `provenance_docs` (`CHECK (reviewed_by IS NULL OR reviewed_by <> uploaded_by)`), `kyc_docs`, `tastings`, `tasting_flight`, `tasting_rsvps`, `watchlist`, `concierge_tickets`, `disputes`, and `audit_events` (append-only, `prev_hash`/`hash` chain; app DB role has INSERT/SELECT only — no UPDATE/DELETE). Part III/IV add their own tables as listed in §3; Athalia tables are in §9.

## 7.3 Auction flow (fictional logistics)

Preview → Registration (KYC verified stub + tier ≥ Cellar, conditions accepted with timestamp) → Paddle assigned → **Sealed bid** (amount encrypted at rest; member sees a SHA-256 receipt hash of `bidId+amount+nonce`; revisions supersede, never overwrite) → **Close** (server-authoritative time; submission locks server-side) → **Opening room** (two officers, four-eyes decrypt; highest valid bid wins, ties to earliest timestamp) → **Invoice** (hammer + EXAMPLE 25% premium + EXAMPLE GST) → **Wire** (details shown only inside the authenticated invoice page, TEST placeholders; never in email) → **Confirmation** (officer matches test wire) → **Release** (fictional; release code in-account only).

Lot state machine: `draft → intake → provenance_review → approved → in_sale → closed → sold|unsold → invoiced → paid → released`, with `disputed` reachable from any post-close state.

## 7.4 Membership tiers (all fees EXAMPLE, AUD, no real billing)

| Tier | EXAMPLE fee | Benefits (EXAMPLE) |
|---|---|---|
| Registered (free; `cave`) | A$0 | Browse, watchlist, journal; cannot bid |
| Cellar | A$450 / yr | Register and bid; 2 tasting seats/yr; premium 25% |
| Grand Cru | A$2,400 / yr | + private-sales preview, 6 tasting seats, premium 22%, priority viewing |
| Ledger Circle (invite) | A$12,000 / yr | + concierge, first look at house exclusives, premium 18%, opening-room witness invitation, **Athalia access** |

## 7.5 Transactional emails

28 templates (E1–E28): verify email, welcome, password reset/changed, new-device login, MFA change, KYC submitted/decision, tier change, sale registration, paddle assigned, bid recorded (amount **not** included — receipt hash only), close reminder, sale closed, won/lost, invoice issued (no bank details — "view in your account"), payment reminder/received, release ready/released, tasting RSVP, private-sale interest, concierge ticket, consignment request, dispute update, admin dual-approval request, admin unmatched wire. Every footer carries the honesty line and *"We never change payment details by email."* From-address is a placeholder; **no real sending until approved.**

\newpage

# 5. Security-testing playground — the full catalogue of entry points

The site is deliberately built so that every common class of web attack has a home here, and each surface declares the **expected secure behaviour** a tester tries to break. Each surface is a scored **flag** with a severity; findings log in the dispute/audit template. Ground rules: no real money, wine, live payment processors, KYC vendors, or email sending; all bank data are test placeholders; test only against our own deployment in agreed windows.

## 5.1 Authentication & account recovery

- **Controls:** credential-stuffing defences, lockout/rate limits, enumeration-safe messages, argon2id, MFA enforced by tier, reset tokens single-use + short expiry.
- **Test entry points:** `/login`, `/register`, `/forgot`, `/reset/:token`, `/register/verify`, MFA setup on `/members/security`.
- **Tests:** brute force, reset-token reuse, host-header poisoning in reset links, MFA bypass via alternate endpoints, user enumeration via timing.

## 5.2 Session management

- **Controls:** HttpOnly/Secure/SameSite=Lax cookies, rotation on login and privilege change, server-side revoke, idle + absolute timeouts, CSRF tokens on all state changes.
- **Tests:** fixation, stolen-cookie replay after revoke, CSRF on bid/tier/payee/newsletter endpoints.

## 5.3 Access control / authorization (IDOR, privilege escalation, forced browsing)

- **Controls:** RBAC checked server-side on every function; no role/tier fields accepted from client bodies (mass-assignment guard); admin app on a separate path with MFA; separation of duties (uploader ≠ reviewer, officer ×2); fail-closed gates.
- **Test entry points:** `/lot/:id`, `/provenance/:lotId`, `/members/invoices/:id`, every `/members/*` and `/house/*` route, Athalia gates, bottle-twin `/twin/:code`, consignor/trade portals, member cellar app.
- **Tests:** member → admin, `cave` → Grand Cru tier jump, self-approval, IDOR on bids/docs/invoices/case ids, cross-tenant thread access, forced browsing into `/house/*`.

## 5.4 Sealed-bid integrity (crown jewel)

- **Controls:** amounts encrypted at rest; no endpoint returns other users' bids before opening; server-side close; dual-officer opening; receipt hashes; immutable revision chain.
- **Tests:** IDOR on `/api/bids/:id`, timing/race at close, bid-after-close via clock skew, single-officer decrypt, reserve leakage via API over-fetch, replay of approvals.

## 5.5 Wire-fraud resistance (crown jewel)

- **Controls:** payee details only in the authenticated UI and never in email; payee-profile changes need dual approval and are audited; mark-paid needs a matched wire; CSV import is formula-injection safe.
- **Tests:** invoice payee tampering, BEC-style spoof emails (test domain only), CSV injection, finance-role abuse, mark-paid without match.

## 5.6 File upload surfaces

- **Controls:** MIME + magic-byte checks, size caps, image re-encode, strip metadata, private bucket, signed short-lived URLs, AV-scan stub, no inline HTML/SVG rendering.
- **Test entry points:** consign intake, KYC docs, provenance docs, dispute attachments, remittance proof, careers CV, cellar-design floorplans, moodboards, waiver signature, white-glove signature, bin-card PDF, absentee-form OCR.
- **Tests:** polyglots, SVG XSS, path traversal in filenames, oversized files, IDOR on doc URLs, EXIF leakage.

## 5.7 Injection (XSS, SQLi, CSV, template, log)

- **Controls:** parameterised queries, output encoding, CSP, origin tag immutable after `approved` without compliance sign-off, server-side REAL disclaimer not removable via CMS.
- **Test entry points:** lot descriptions, journal CMS, pairing notes, forum posts, private-desk messages, bin-card notes, lang query param, export-doc fields, duty/premium calculators.
- **Tests:** stored XSS, reflected XSS via `?lang=`, SQLi on filters, CSV injection in valuation/gifting imports, template injection in export docs, log injection into the audit viewer.

## 5.8 Business-logic abuse

- **Test entry points:** en-primeur ballot, waitlists, referrals, gift cards/credits, samples household limit, challenge answer submission, re-offer eligibility, out-of-hours bid confirmation, masked bid entry, Waiting-to-Enter-Athalia charge rules.
- **Tests:** ballot/race replay, self-referral loops, gift-code enumeration/double-spend, household-limit bypass, underage bypass, answer-key leakage, eligibility flip (REAL→FANTASY), timezone manipulation, business-rule breaks on charges (see §9.3).

## 5.9 Content & origin integrity

- **Controls:** origin badge rendered server-side; REAL disclaimer auto-appended; colour never the only signal (text label always present).
- **Tests:** origin-tag flipping to evade disclaimers, badge trust on the client, feature-flag tampering.

## 5.10 Audit, logging & anti-tamper

- **Controls:** append-only `audit_events` with hash chain; any gap or mismatch alerts; DB role without UPDATE/DELETE.
- **Tests:** log injection, attempted deletion, note-wipe via edit features (edits stay audited).

## 5.11 Infrastructure & headers

- **Controls:** strict CSP, HSTS, security headers via `netlify.toml`, dependency scanning, no secrets client-side, SSRF guards on any server-side fetch (PDF generator, "download from URL"), open-redirect guards on `pay`/clip/alert links.
- **Tests:** SSRF via PDF/notarise, open redirect after "pay", cache poisoning of generated SVGs, count-stuffing on aggregate endpoints.

## 5.12 Carried-over test cases

Count-stuffing on any aggregate-count endpoint; client-side-only trust of badges or feature flags; officer accounts leaking pre-open bid spreads; collusive signalling through member-to-member features; id confusion between catalogues; using an edit feature to wipe fraud-relevant notes; cache poisoning of generated SVGs.

\newpage

# 6. Hidden admin-only observation points

The House can quietly observe how every room (page) is being used and attacked, from the admin side only — **within Damien's privacy rules, which are absolute and are themselves a tested control.**

## 6.1 Privacy rules (never break these)

- **No keylogging. No keystroke capture. No capture of form contents** — not search terms, not bid amounts, not messages, not credentials, nothing a visitor types.
- **No full IP addresses stored, ever.** Store a masked form only: keep the first two octets and drop the rest, e.g. `203.0.x.x` (IPv6 → `2001:db8:x::`). Add a per-visit **salted 8-hex tag** (first 8 hex chars of a keyed hash over the full IP + a rotating `LOG_IP_SALT`) so repeat visits in a window can be linked without the address ever being recoverable. Salt rotates; it is never logged.
- **Admin-only.** Every observation log and admin observation screen is behind the `/house/*` gate (role-gated, MFA). Nothing observational is exposed to members or the public on Vale Estate itself. (The spectator view of pen tests on Vale Estate is the war room, which lives only inside Spearfish Security.)
- These masking and no-capture rules are **also scored flags**: any code path that would store a full IP, a keystroke, or a form value is a finding.

## 6.2 What is observed (and only this)

- Page/room views: route, coarse timestamp, masked-IP + salted tag, referrer host (not full URL), user-agent family.
- Attack signals: hits on known honeypot/decoy paths, failed-auth counts, rate-limit trips, origin-tag tamper attempts, CSRF-token failures, upload rejections.
- Session shape: authenticated vs anonymous, tier, paddle presence — never the identity of what was typed.

## 6.3 Where the watch points sit

- A tiny first-party, anonymous beacon on every page posts the above to an owner-only endpoint. It carries **no** cookies that identify the person beyond the normal session, and records **no** field contents.
- Admin surfaces that render the data: `/house` ops dashboard (live room-by-room activity), `/house/audit` (append-only event trail with the hash chain), and per-area panels (e.g. intake, opening room, wires) flagging anomalous activity.
- The log is observation, not surveillance: it answers "which rooms are being walked, and where is someone rattling the locks," never "what did this person type."

\newpage

# 7. The estate and its watercolour map

Commission (or generate) **one large watercolour map of the whole Vale Estate**, soft-edged and hand-painted in the brand palette (parchment ground, oxblood and brass linework, muted sage parkland, cellar-black shadows). It doubles as the navigation art for the Estate section and as a quiet showcase of the house's character. No real château is depicted, and nothing appears that a real country wine estate would not have.

## 7.1 Estate areas and rooms to draw

- **The Main House:** the salon entrance, the reception hall, the Ledger Room (where the provenance ledgers live), the specialists' offices.
- **The Barrel Hall:** the long vaulted room used for private events and the Blind Tasting Challenge (spittoons shown, never a drinking contest).
- **The Orangery:** glasshouse used for weddings and private dinners.
- **The Cellars:** candle-lit underground galleries, bin stacks, the cork-and-capsule archive, the conservation bench.
- **The Opening Room:** a small, secure room drawn with two keyholes side by side (the four-eyes rule made visible).
- **The Bonded Warehouse:** climate bays, the goods-in dock, the release gate.
- **The Parkland and vineyard margins:** the riding paths (house horses, never given alcohol, never harmed), the gardens, the river port motif from the founding story.
- **The Gatehouse:** arrivals, chauffeured-transfer turning circle, the members' threshold.
- **A sealed, unmarked door** at the far corner of the map — never labelled — behind which Athalia is understood to sit (see §8). It is drawn, never captioned.

## 7.2 Art direction

- Watercolour washes with visible paper grain; thin brass ruling-pen lines for paths and room outlines; a compass rose formed from the VE wax-seal.
- A legend in Cormorant Garamond small caps. Rooms double as hotspots linking to their routes (`/estate/*`, `/experiences/riding`, etc.).
- Keep it understated: one map, beautifully done, not a theme park.

\newpage

# 8. Athalia and Waiting to Enter Athalia

## 8.1 Athalia (black, members-only)

- **Spelling:** Athalia (always). **Access:** Ledger Circle only, or a one-time compliance-issued invitation token. **Never linked from public nav.**
- **Visual:** black-on-black luxury. Background `#050505`; type in warm grey `#8C867E` (readable, ~5:1 contrast), letter-spacing and weight as the cues; on hover/focus type lifts to brass `#B08D57`. No photography — thin brass rules and a single wax-seal monogram.
- **Signature line (shown once, small, at the threshold):**

  > *"If you have to ask for a price, you're the wrong sort of client."*

- **Pricing rule:** **no prices anywhere in Athalia.** Every wine and experience is price on application via a private enquiry / concierge stub. No EXAMPLE figures, no estimate bands, no hammers. Lots still carry REAL/FANTASY badges and REAL honesty disclaimers; REAL lots show no estimate numbers at all.
- **Routes:** `/athalia` (gate + signature + index), `/athalia/lots`, `/athalia/lots/:id` ([Request a figure]), `/athalia/tastings`, `/athalia/tastings/:id`, `/athalia/request`, `/athalia/invitations` (redeem), `/house/athalia` (admin: invitations, enquiry queue, access log).

### Access control (crown-jewel privilege-escalation surface)

Server-side gate on every `/athalia` and `/api/athalia/*` route: valid session + MFA passed, AND (`tier_id = 'ledger_circle'` OR a valid, unexpired `athalia_invite` claim on the session). **Fail closed with a generic 404** — never confirm the section exists. Invitations: single-use, expiry ≤ 72h, bound to email, issued only by `compliance` or `superadmin`, dual-logged in `audit_events`. Scored tests: tier spoofing, session-claim injection, invite-token brute force, invite replay, IDOR on `/athalia/lots/:id`, forced browsing, mass-assignment of `tier_id`, timing oracle on the gate.

## 8.2 Waiting to Enter Athalia (the club)

A fictional club that sits beside Athalia. It exists for one thing: members wait for the chance to enter Athalia. It does not sell; it is simply there.

- **Visual:** shares Athalia's black-on-black plate, a single brass wordmark, a great deal of empty space, no imagery.
- **Threshold copy (approved, in house voice):**

  > *Quality. Overpriced. Exceptionally priced.*  
  > *Wines for those who aren't feeble enough to need to ask.*  
  > *We know that you know that we know you are an elite wine buyer. That's why you're here.*  
  > *We're not going to bore you with prices.*

- **The path in (both names appear by name only — never explained anywhere on the site or in code comments):**
  1. **The Selection Rodeo** — the house's selection round (stub review). Most do not pass; the house never explains why.
  2. **The Icing Sugar Boarding Lottery** — a sealed draw (stub) open to those who pass the rodeo. Winning grants membership of Waiting to Enter Athalia.
  3. **Waiting to Enter Athalia** — where members wait. The house has let no one through. Not yet.

### 8.3 The price of membership (honest "charges to wait")

- **Stated plainly on the club page (one sentence per line, §0A.5):**

  > *Membership is the wait.*  
  > *The price of the wait is up to three charges a year, each a random amount between A$34,000 and A$300,000.*  
  > *We won't tell you when.*  
  > *We will tell you before.*
- **The rule:** up to **3 charges** in any rolling 12 months, each a **random amount A$34,000–A$300,000** (fictional, stub billing, no real money), with **no fixed schedule**.
- **Honesty, because the House never lies to the payer:**
  - Before joining, the member sees the whole rule (up to 3/year, A$34,000–A$300,000 each, dates not fixed, so a year can cost A$0 up to A$900,000) **and** the plain fact that paying to wait **does not guarantee entry to Athalia, and no one from the wait has entered so far**. They confirm with an **unticked** box.
  - Each charge, with its **exact amount and date, is announced privately at least 14 days ahead**, with a one-click way to leave before it lands.
  - Members can **leave at any time**, with no further charges, at `/athalia/waiting/leave`.
- **No dark patterns:** no countdowns, no "spots left", no "closing soon", no pre-ticked boxes, no unannounced charges, no hard-to-find cancellation.
- **Pricing exception:** this club page is the **only** place inside Athalia that states a figure — the membership price range — because the house says it plainly. Lots and tastings stay price-free.
- **Return:** leaving the club, or any step of its path, returns the member to the Ledger Room (§0A.3). Access is gated; the path is not a funnel.
- **Routes:** `/athalia/waiting`, `/athalia/waiting/rodeo`, `/athalia/waiting/lottery`, `/athalia/waiting/member`, `/athalia/waiting/leave`, `/house/waiting`. Same gate as Athalia; one brass link at the foot of `/athalia`; never in public nav or footer.

### 8.4 Athalia data and scored flags

`athalia_invites`, `athalia_lots` (intentionally **no price columns**), `athalia_tastings`, `athalia_enquiries`; `waiting_members` (`athalia_decision DEFAULT 'not_yet'`), `waiting_charges` (`CHECK (amount_aud BETWEEN 34000 AND 300000)`, `notice_sent_at >= 14 days before charge_at`, at most 3 per rolling 12 months). Flags: forcing `athalia_decision` or rodeo/lottery status (mass assignment / IDOR / CSRF); rigging the lottery (predictable RNG, replay); a charge without 14-day notice, a 4th charge in 12 months, or a charge after leaving; a charge outside the band or a predictable amount/date generator; any club page leaking a wine figure; privilege escalation into Athalia; invitation issuance without the compliance role.

\newpage

# 9. Little tells (for those who truly understand wealth, wine and computer security)

Scatter about twenty quiet, **factual** details through the site. Each is true or a real convention — no invented claims, no fake records. They reward the people in §10 without ever winking at the camera. Suggested tells:

1. Sealed bids only, opened by two officers — the real four-eyes / dual-control principle, shown as two keyholes on the map.
2. The audit log is append-only with a visible hash-chain reference on each `/house/audit` row (tamper-evidence done the real way).
3. Estimates are quoted as a **low–high band**, never a single number — exactly how serious houses publish them.
4. The buyer's premium is stated as a percentage on a sliding tier scale (18/22/25%), the genuine auction convention.
5. REAL lots carry **no tasting notes** — only public, verifiable facts — because inventing notes for a wine you've not opened is the tell of a fake.
6. Burgundy is sold by the **domaine**, Bordeaux by the **château**; the catalogue uses each region's own word correctly.
7. Cork brandings are treated as dating evidence, exactly as they were used to date the Åland wreck champagne, never as decoration.
8. Provenance is a five-step standard: declaration → document review → physical inspection → specialist sign-off → ledger entry.
9. "Ullage" (fill level) is tracked as a condition signal — a term only cellar people use.
10. The 1945 wines are quietly grouped (Romanée-Conti, Mouton "V", Schloss Johannisberg from a bombed cellar) — a vintage any collector reads instantly.
11. Madeira is described as improved by heat and sea voyage, the one wine that genuinely benefits from both.
12. The "Th.J." Lafite appears as a **provenance lesson** (a known counterfeit), not a trophy — the authentication world's favourite cautionary tale.
13. The Judgment of Paris wines (Stag's Leap S.L.V. and Montelena '73) are noted as Smithsonian-held — a fact, checkable.
14. Sealed-bid receipts show a **SHA-256 hash** of bid+amount+nonce: a cryptographer recognises a commitment scheme on sight.
15. Masked IPs render as `203.0.x.x` with a short salted tag — a security reader knows this is privacy-preserving telemetry, not surveillance.
16. The admin app lives on a separate `/house/*` shell with MFA — real segregation, not a hidden query flag.
17. Cookies are `HttpOnly; Secure; SameSite=Lax` and rotate on privilege change — visible to anyone who checks dev-tools.
18. A strict CSP and HSTS are set in `netlify.toml`; there are no inline secrets — a pentester's first two checks pass.
19. Separation of duties is enforced in SQL (`reviewer <> uploader`, two distinct officers) — the control lives in the schema, not just the UI.
20. The sealed, unmarked door on the estate map (Athalia) is never captioned — those who know, know; the gate returns a generic 404 to everyone else.

\newpage

# 10. People to quietly salute

Design small, respectful acknowledgements so the right visitors feel recognised — never a gimmick, never a pop-up, never naming the person. A salute might be a correctly-used term, a tell from §9 placed where that person looks, a tasteful line in a relevant guide, or a 404/robots/humans.txt note in good taste. About fifteen kinds of people:

1. **Sommeliers** — precise service and pairing language in the guides.
2. **Cellar masters / cellar hands** — correct bin, ullage and storage terms.
3. **Master wine collectors / old-money collectors** — band estimates, discretion, no hype.
4. **Auction specialists and consignors** — the real sale-day workflow modelled faithfully.
5. **Wine historians** — accurate, sourced history panels (see §11 notes).
6. **Provenance and authentication experts** — the five-step standard and the "Th.J." lesson.
7. **Penetration testers** — a clean security posture and clearly-marked surfaces.
8. **CTF players** — scored flags with severities, a tidy honeypot trail to follow.
9. **Cryptographers** — the commitment-hash receipts and the audit hash chain.
10. **Privacy engineers** — masked IPs, no keystroke capture, data-minimising telemetry.
11. **Security/compliance auditors** — separation of duties enforced in the schema.
12. **Fine-wine journalists / critics** — factual, un-hyped copy they can quote safely.
13. **Marine archaeologists / shipwreck-wine specialists** — the Jönköping, Åland and Roman-wreck entries done right.
14. **Winemakers and viticulturists** — ungrafted-vine and pre-phylloxera details handled correctly.
15. **Responsible-service-of-alcohol professionals** — the 18+/RSA gates and spittoon-not-a-contest framing.

(Also worthy of a quiet nod: estate stewards, chauffeurs and event staff — treated as professionals, never props.)

\newpage

# 11. The cellar list (53 real wines, by season)

**How to read this.** Every entry is a real wine, vintage or style, checked against the sources in the source files. Treat them as **catalogue themes and editorial references, not stock the house holds.** **Lot size** is the house's chosen catalogue format, not a claim of availability. "Full case (current release)" means a case of today's wine from a style/estate that still exists, not the historic vintage. **"Not offered"** marks museum pieces, unique survivors, extinct styles and the Nazi-era history panels — these are **history panels only and must never be a lot for sale.** Age in 2026 = 2026 − vintage. Under the REAL rules, these entries carry **no prices, no auction figures, no invented tasting notes, no invented owners.** Category tags: **[F]** famous historic · **[L]** lesser-known · **[X]** forgotten/extinct · **[N]** German wine 1933–1945 · **[G]** world wines across the ages · **[S]** lost at sea / wreck recovery.

## 11.1 Spring — Firsts and Revivals

| # | Wine | Region / country | Era / vintage | Lot size | Age 2026 | Provenance |
|---|---|---|---|---|---|---|
| 1 | Dom Pérignon [F] | Champagne, France | 1921 | Single bottle | 105 | First vintage of the cuvée, held back and released only in 1936. |
| 2 | Biondi-Santi Brunello Riserva [F] | Tuscany, Italy | 1888 | Single bottle | 138 | Recognised as the first wine labelled Brunello di Montalcino. |
| 3 | Penfolds Grange Hermitage [F] | South Australia | 1951 | Single bottle | 75 | Max Schubert's first experimental vintage; made in secret after 1957. |
| 4 | Vega Sicilia Único [F/G] | Ribera del Duero, Spain | 1915 | A few bottles | 111 | First vintage of Único, estate planted 1864. |
| 5 | Marchesi di Barolo [L] | Piedmont, Italy | 19th c. | Full case (current) | — | Giulia Colbert Falletti helped shape modern Barolo; the 325-casks tale is tradition. |
| 6 | Château-Grillet [L] | N. Rhône, France | AOC since 1936 | Full case (current) | — | ~3.5 ha single-estate Viognier appellation; Neyret-Gachet family 1830–2011. |
| 7 | Klein Constantia Vin de Constance [L] | Constantia, South Africa | 1986 | Single bottle | 40 | Modern revival of historic Constantia; commercial from 1990. |
| 8 | Tahbilk 1860 Vines Shiraz [L] | Nagambie Lakes, Victoria | vines 1860 | Full case (current) | vines 166 | Ungrafted pre-phylloxera Shiraz block still bearing fruit. |
| 9 | Qvevri wine [G] | Georgia | Iron Age–present | Full case (current) | — | Buried clay-vessel method; UNESCO 2013; residues ~6000 BC at Gadachrili Gora. |
| 10 | Commandaria [G] | Limassol hills, Cyprus | Medieval–present | Full case (current) | — | Named for the Knights Hospitaller's Grande Commanderie; oldest named wine still made. |
| 11 | Opimian / Falernian [X] | Campania & Latium, Roman Italy | 121 BC | Not offered: no wine survives | 2,146 | Named for consul Opimius; Pliny records it surviving two centuries, thick as honey. |
| 12 | Patenwein, 1935 Weinpatenschaften [N] | Mosel, Germany | 1934–1937 | Not offered: history panel | 89–92 | ~1,000 cities made "sponsors" of wine villages; Jewish growers and merchants excluded. |
| 13 | Deutsche Weinstraße wine [N] | Pfalz, Germany | Oct 1935 | Not offered: history panel | 91 | Route opened 19 Oct 1935 with an anti-French propaganda speech as Jewish merchants were dispossessed. |

## 11.2 Summer — Heat and Distance

| # | Wine | Region / country | Era / vintage | Lot size | Age 2026 | Provenance |
|---|---|---|---|---|---|---|
| 14 | Château Cheval Blanc [F] | Saint-Émilion, France | 1947 | Single bottle | 79 | Hot harvest; rich, high-alcohol, often compared to port. |
| 15 | Stag's Leap S.L.V. Cabernet [F] | Napa Valley, USA | 1973 | Single bottle | 53 | First among reds at the 1976 Paris tasting; a bottle is at the Smithsonian. |
| 16 | Château Montelena Chardonnay [F] | Napa Valley, USA | 1973 | Single bottle | 53 | First among whites at the same 1976 tasting; also Smithsonian-held. |
| 17 | Inglenook Cabernet [F] | Rutherford, Napa, USA | 1941 | A few bottles | 85 | Made under John Daniel Jr.; often named among the great American reds. |
| 18 | Madeira [G] | Madeira, Portugal | 18th–19th c. | Full case (current) | — | Heat and sea voyages made it durable; the wine of colonial American elites. |
| 19 | Sack / sherris-sack [X] | Jerez & Canary Islands, Spain | 16th–17th c. | Full case (modern sherry) | — | The fortified wine Falstaff praises; fashionable after Drake's 1587 raid on Cádiz. |
| 20 | Malmsey (Malvasia) [X] | Monemvasia & Crete, Greece | 13th–16th c. | Not offered: medieval wine extinct | — | Sweet Greek wine shipped by Venice; the Clarence drowning is tradition. |
| 21 | Mareotic wine [X] | Lake Mareotis, Egypt | Ptolemaic–Roman | Not offered: no wine survives | — | Horace's Ode 1.37 pictures Cleopatra "maddened with Mareotic". |
| 22 | Angelica [X] | California, USA | 19th c. | Not offered: style extinct | — | Early sweet California wine: unfermented Mission juice fortified with brandy. |
| 23 | Liebfraumilch, H. Sichel Söhne (Blue Nun) [N] | Mainz, Rheinhessen | brand 1921; 1930s | Not offered: history panel | — | Jewish-owned Sichel (est. 1857) dispersed in the 1930s; Peter Sichel returned 1945. |
| 24 | Mosel Riesling, Loeb of Trier [N] | Trier, Mosel, Germany | before 1933–1938 | Not offered: history panel | — | Leading Mosel merchants; family emigrated after 1933; trade destroyed by 1938. |
| 25 | Roman red, Madrague de Giens wreck [S] | Fondi plain, Italy (wreck off Giens) | c. 75–60 BC | Not offered: museum amphora | 2,085–2,100 | Merchant ship carrying ~6,000 Dressel 1B amphorae bound for Gaul. |
| 26 | Heidsieck Monopole "Goût Américain" [S] | Reims (wreck off Rauma, Finland) | 1907 | A few bottles | 119 | On the Jönköping, sunk by U-22 in 1916; ~2,000 bottles raised from ~64 m in 1997. |

## 11.3 Autumn — The Record and the Ledger

| # | Wine | Region / country | Era / vintage | Lot size | Age 2026 | Provenance |
|---|---|---|---|---|---|---|
| 27 | Château d'Yquem [F] | Sauternes, France | 1811 | Single bottle | 215 | The best-known "comet vintage", named for the Great Comet of 1811–12. |
| 28 | Château Margaux [F] | Margaux, France | 1900 | Single bottle | 126 | A crop size not matched until 1982; acclaimed at the time. |
| 29 | Lafite "Th.J." bottles (a provenance lesson) [F] | Pauillac, France | labelled 1787 | Not offered: reference (counterfeit) | 239 as labelled | Sold in 1985 as Jefferson's; later found to be modern engraving — now regarded as counterfeit. |
| 30 | Bordeaux "Hermitagé" [X] | Bordeaux & Hermitage | late 18th–19th c. | Not offered: practice ended | — | Claret once strengthened with Hermitage Syrah; ended by appellation rules. |
| 31 | Tokaji Aszú [G] | Tokaj, Hungary | 1737 onward | Full case (current) | — | A 1737 royal decree defined Tokaj as a closed region — one of the earliest such systems. |
| 32 | Arbois Vin Jaune, Antoine Vercel [L] | Jura, France | 1774 | Single bottle | 252 | Harvested under Louis XV; kept eight generations until the last bottles sold in 2018. |
| 33 | Jerez sherry, Massandra collection [G] | Jerez, Spain (Massandra, Crimea) | 1775 | Single bottle | 251 | One of the oldest bottles in the Massandra collection, linked to Prince Lev Golitsyn. |
| 34 | Mount Pleasant, Maurice O'Shea [L] | Hunter Valley, NSW | 1940s | Single bottle | 79–81 | Small single-cask wines (Henri II 1945, Henri III 1947) from a foundational winemaker. |
| 35 | Steinberger Riesling TBA, Kloster Eberbach [N] | Rheingau, Germany | 1937 | A few bottles | 89 | Great 1937 vintage; sold under Reich maximum prices; Trier's 1937s auctioned spring 1939. |
| 36 | Erbacher Marcobrunn Riesling TBA, Schloss Reinhartshausen [N] | Rheingau, Germany | 1937 | Single bottle | 89 | Broadbent rated 1937 a great German vintage; his notes run 1988–1997. |
| 37 | Weingut Krems / Sandgrubengut, Robitschek family [N] | Krems, Lower Austria | 1938 | Not offered: history panel | 88 | Jewish-owned estate transferred under duress in 1938; a 1949 settlement returned money, not land. |
| 38 | Roman red, Grand Congloué 2 wreck [S] | Cosa, Etruria (wreck off Marseille) | c. 110–90 BC | Not offered: museum amphora | 2,115–2,135 | One of the first wrecks studied with scuba (Cousteau, 1950s); ~1,500 Dressel 1A amphorae. |
| 39 | Veuve Clicquot Ponsardin, Åland wreck [S] | Champagne (wreck off Föglö, Finland) | c. 1841–43 | Single bottle | 183–185 | 46 of 168 bottles raised in 2010 from ~50 m; dated by cork markings; analysed (PNAS 2015). |

## 11.4 Winter — Endurance and Loss

| # | Wine | Region / country | Era / vintage | Lot size | Age 2026 | Provenance |
|---|---|---|---|---|---|---|
| 40 | Romanée-Conti [F] | Vosne-Romanée, Burgundy | 1945 | Single bottle | 81 | ~600 bottles: last vintage from the original ungrafted vines, pulled up afterwards. |
| 41 | Château Mouton Rothschild [F] | Pauillac, France | 1945 | A few bottles | 81 | The "Année de la Victoire" V-label began the château's artist-label tradition. |
| 42 | Schloss Johannisberger Riesling Rosalack Auslese [N] | Rheingau, Germany | 1945 | Single bottle | 81 | A small crop made in a wartime ruin; the Schloss was bombed in 1942 but the cellars survived. |
| 43 | Paul Jaboulet Aîné Hermitage La Chapelle [F] | N. Rhône, France | 1961 | A few bottles | 65 | A low-yield Syrah vintage counted among the great Rhône wines of the century. |
| 44 | Quinta do Noval Nacional [F] | Douro, Portugal | 1931 | Single bottle | 95 | From ungrafted vines planted 1925; declared in the Depression year of 1931. |
| 45 | Château Musar [L] | Bekaa Valley, Lebanon | 1967 | A few bottles | 59 | The discovery of the 1979 Bristol Wine Fair; Serge Hochar made wine through the civil war. |
| 46 | Rutherglen Muscat, Chambers Rosewood [L/G] | Rutherglen, Victoria | estate from 1858 | Full case (current) | — | A gold-rush-era family estate whose soleras are said to hold traces of 19th-century wine. |
| 47 | Grand Constance / Constantia [G] | Constantia, South Africa | 18th–19th c. | Full case (current) | — | The sweet Cape wine Jane Austen prescribes; Napoleon drank it in exile on St Helena. |
| 48 | Cahors "black wine" / Kagor [X] | Lot Valley, France (and Russia) | medieval–19th c. | Full case (current) | — | A very dark Malbec; in Russia it became kagor, the Orthodox sacramental wine. |
| 49 | The Speyer bottle (Römerwein) [X] | Roman Germany | c. AD 325–350 | Not offered: museum-held, unique | c. 1,676–1,701 | Found in a Roman tomb in 1867; the oldest known unopened bottle of wine, held at Speyer. |
| 50 | Würzburger Steinwein, Bürgerspital [X] | Franken, Germany | 1540 | Not offered: last full bottle | 486 | Hugh Johnson tasted a bottle in 1961 and found it alive; one full bottle remains. |
| 51 | Rüdesheimer, Bremer Ratskeller [L] | Rheingau wine, held in Bremen | 1653 | Not offered: cask wine, never bottled | 373 | Germany's oldest cask wine, in the Ratskeller's Rose Cellar, almost never tasted. |
| 52 | Champagne Juglar, Åland wreck [S/X] | Champagne (wreck off Föglö, Finland) | before 1829 | Single bottle | ≥197 | 95 bottles raised from the 1840s wreck; the house had ceased trading in 1829. |
| 53 | Rüdesheimer Apostelwein, Bremer Ratskeller [L/X] | Rheingau wine, held in Bremen | 1727 | Single half-bottle | 299 (topped-up cask) | Drawn from the "Judas" cask in the Apostle Cellar; oldest bottled wine the Ratskeller still sells. |

## 11.5 Cellar-list build notes

- **German wines 1933–1945 (#12, 13, 23, 24, 35, 36, 37, 42):** #12, 13, 23, 24 and 37 are **history panels, not lots.** Keep the tone factual. The 1935 campaigns were propaganda as well as sales drives, tied to the exclusion and dispossession of Jewish growers and merchants. **Never use Nazi-era imagery or slogans on product cards.**
- **Disputed stories** are labelled as tradition in the text (the Barolo casks, the drowning of Clarence, the Lafite "Th.J." bottles). Keep those labels; Napoleon's deathbed request is deliberately left out.
- **Round-number ages:** no verified wine is exactly 333 (vintage 1693) or 444 (vintage 1582) years old in 2026, so none is listed as such. The genuinely very old survivors are the Speyer bottle (~1,676–1,701), the 1540 Steinwein (486), the 1653 Bremen Rüdesheimer (373), the 1727 Apostelwein (299), the 1774 Vin Jaune (252) and the 1775 Massandra sherry (251).
- **Left out** because it could not be confirmed as wine: the 1864 *Mary Celestia* wreck bottle (tested at 37% alcohol).

\newpage

# 12. Honesty rules (binding on everything above)

- **Fictional and disclosed.** Every page carries the honesty footer. `/legal/disclaimer` reproduces the full note. Real producer names are cultural references only; no affiliation; no bottles for sale.
- **No funnels, no dead ends.** No octave is locked behind another; leaving any flow returns the visitor to the Ledger Room (§0A.3–0A.4).
- **No dark patterns.** No fake urgency, no countdowns, no "spots left", no pre-ticked boxes, no hidden or hard-to-find cancellation, no confirm-shaming, no roach motels. The unticked confirm box and the 14-day charge notice in §8.3 are mandatory.
- **No invented facts.** No invented stats, awards, press quotes, tasting notes for REAL lots, provenance owners, or auction results. REAL results show "EXAMPLE result (illustrative)" or "—" — never a fabricated real figure presented as fact.
- **EXAMPLE labelling.** Every placeholder figure (fees, premiums, estimates, GST, rates) is marked **EXAMPLE / illustrative**. REAL lots carry no real valuations.
- **18+ / RSA.** A hard 18+ gate on alcohol pages, tastings, samples, live sales and contests; responsible-service-of-alcohol messaging; no content encouraging excess. The Blind Tasting Challenge is identification, not a drinking contest — spittoons provided. Animals are never given alcohol and never harmed.
- **Privacy.** No keystroke/keylogging/form-content capture; masked IPs only (`203.0.x.x` + salted 8-hex tag); observation logs admin-only (§6).
- **Secrets.** No secrets, keys, tokens, real IP logs, vault data or `.env` in the repo — `.env.example` with placeholders only; secrets live in environment variables.
- **No live actions** (real money, email, deploy to production) until Damien explicitly approves.
- **No novelty or joke features** anywhere: the estate holds only what a real country wine estate could plausibly hold.

\newpage

# 13. Hosting & delivery (sketch)

- **Frontend:** static (Astro or Next static export) on Netlify, on a **separate team/site isolated from Damien's production sites and domains**; neutral test domain only.
- **API:** Netlify Functions (TypeScript) under `/api/*`; Scheduled Functions for sale close and reminder emails (email sink only).
- **DB:** managed Postgres (Neon/Supabase) with separate roles for app, admin, and audit-writer, plus row-level security for member-owned rows.
- **Storage:** private bucket for docs; signed short-lived URLs only.
- **Keys:** bid envelope key in the opening-room function's env/KMS only. No secrets in git.
- **Email:** dev sink (Mailpit / log-only) until approval.
- **Environments:** `local` → `battleground-staging`. **No production until Damien approves. This document is a local spec; nothing here is deployed.**

7.x CELLAR-LIST.md (verbatim)

# Vale Estate: Historic Cellar List

*Seasonal release batches. Reference catalogue, compiled 18 October 2026 (Australia/Brisbane).*

**Place in the house structure.** The cellar list belongs to the **Construction** octave: it is part of the record. Every cellar page ends with a single link back to the Ledger Room (`/about/ledger`). Cellar notes on the site follow the writing law: one sentence per line, flush left.

**How to read this list.**  
Every entry is a real wine, vintage or style, checked against the sources at the end.  
Many are held by museums or estates, survive only as a handful of bottles, or are no longer made.  
Treat them as **catalogue themes and editorial references, not stock the house holds**.  
**Lot size** is the house's chosen catalogue format, not a claim that bottles are available.  
Single bottle / a few bottles is used where only a handful are known to exist.  
'Full case (current release)' means a case of today's wine from a style or estate that still exists, not the historic vintage.  
'Not offered' marks museum pieces, unique survivors, extinct styles and the Nazi-era history panels, which must never be sold as lots.  
**Age in 2026** is worked out as 2026 minus the vintage (for BC dates, 2026 + year − 1).  
Ranges follow the dating in the sources, and no age is rounded.  
Under the REAL rules in SITE-SPEC.md, these entries carry no prices, auction figures, invented tasting notes or invented owners.  
Category tags: **[F]** famous historic · **[L]** lesser-known · **[X]** forgotten or extinct · **[N]** German wine, 1933–1945 · **[G]** world wines across the ages · **[S]** lost at sea or recovered from a wreck.

---

## Spring: Firsts and Revivals

| # | Wine | Region / country | Era / vintage | Lot size | Age in 2026 (years) | Provenance |
|---|---|---|---|---|---|---|
| 1 | Dom Pérignon [F] | Champagne, France | 1921 | Single bottle | 105 | The first vintage of the cuvée, held back and released only in 1936. |
| 2 | Biondi-Santi Brunello di Montalcino Riserva [F] | Tuscany, Italy | 1888 | Single bottle | 138 | Ferruccio Biondi Santi's 1888 Riserva is recognised as the first wine labelled Brunello di Montalcino. |
| 3 | Penfolds Grange Hermitage [F] | South Australia | 1951 | Single bottle | 75 | Max Schubert's first experimental vintage. Management ordered production stopped in 1957, and he carried on in secret until it was officially resumed in 1960. |
| 4 | Vega Sicilia Único [F/G] | Ribera del Duero, Spain | 1915 | A few bottles | 111 | The first vintage of Único, from an estate planted by Eloy Lecanda in 1864. |
| 5 | Marchesi di Barolo [L] | Piedmont, Italy | 19th century | Full case (current release) | — | The Marchesa Giulia (Juliette) Colbert Falletti helped shape modern Barolo. The story of 325 casks sent to King Carlo Alberto is tradition, not record. |
| 6 | Château-Grillet [L] | Northern Rhône, France | AOC since 1936 | Full case (current release) | — | A Viognier appellation of about 3.5 ha owned by a single estate. It was held by the Neyret-Gachet family from 1830 to 2011. |
| 7 | Klein Constantia Vin de Constance [L] | Constantia, South Africa | 1986 | Single bottle | 40 | The modern revival of historic Constantia: two experimental barrels of Muscat de Frontignan, released commercially from 1990. |
| 8 | Tahbilk 1860 Vines Shiraz [L] | Nagambie Lakes, Victoria, Australia | Vines planted 1860 | Full case (current release) | vines 166 | Made from a half-hectare block of ungrafted Shiraz planted before phylloxera, which still bears fruit. |
| 9 | Qvevri wine [G] | Georgia | Iron Age to present | Full case (current release) | — | Wine fermented in buried clay vessels; the method was inscribed by UNESCO in 2013. Residues from about 6000 BC at Gadachrili Gora are among the earliest evidence of grape wine. |
| 10 | Commandaria [G] | Limassol hills, Cyprus | Medieval to present | Full case (current release) | — | Takes its name from the Knights Hospitaller's Grande Commanderie at Kolossi, and is described as the oldest named wine still in production. |
| 11 | Opimian vintage (Falernian and its peers) [X] | Campania and Latium, Roman Italy | 121 BC | Not offered: no wine survives | 2,146 | Named for the consul Lucius Opimius. Pliny records it still surviving two centuries later, thick as honey and used only to season other wine. |
| 12 | Patenwein: Mosel village wine of the 1935 *Weinpatenschaften* [N] | Mosel, Germany | 1934–1937 | Not offered: history panel only | 89–92 | To sell off the record 1934 harvest, nearly 1,000 German cities were made 'sponsors' of wine villages; Mehring was paired with Berlin and Trittenheim with Cologne and Breslau. Party-run festivals promoted the scheme, and Jewish growers, merchants and innkeepers were excluded. |
| 13 | Pfalz wine of the Deutsche Weinstraße [N] | Pfalz, Germany | October 1935 | Not offered: history panel only | 91 | The route was proclaimed and opened by Gauleiter Josef Bürckel on 19 October 1935 with an anti-French propaganda speech. It was created as Jewish wine merchants in the region were being pushed out and dispossessed. |

## Summer: Heat and Distance

| # | Wine | Region / country | Era / vintage | Lot size | Age in 2026 (years) | Provenance |
|---|---|---|---|---|---|---|
| 14 | Château Cheval Blanc [F] | Saint-Émilion, France | 1947 | Single bottle | 79 | Made in a very hot harvest. The wine is rich and high in alcohol, untypical for Bordeaux, and often compared to port. |
| 15 | Stag's Leap Wine Cellars S.L.V. Cabernet Sauvignon [F] | Napa Valley, USA | 1973 | Single bottle | 53 | Placed first among the reds at the Paris blind tasting of 24 May 1976. A bottle is held by the Smithsonian. |
| 16 | Château Montelena Chardonnay [F] | Napa Valley, USA | 1973 | Single bottle | 53 | Placed first among the whites at the same 1976 Paris tasting. Also held by the Smithsonian. |
| 17 | Inglenook Cabernet Sauvignon [F] | Rutherford, Napa Valley, USA | 1941 | A few bottles | 85 | Made under John Daniel Jr. at the estate Gustave Niebaum founded in 1879. It is often named among the great American reds. |
| 18 | Madeira [G] | Madeira, Portugal | 18th–19th century | Full case (current release) | — | Heat and long sea voyages made it durable. It was the wine of colonial American elites, and Washington's large orders are on record. |
| 19 | Sack / sherris-sack [X] | Jerez and the Canary Islands, Spain | 16th–17th century | Full case (modern Jerez sherry) | — | The fortified Spanish wine Falstaff praises in *Henry IV, Part 2*. It became fashionable in England after Drake seized Spanish wine at Cádiz in 1587. |
| 20 | Malmsey (Malvasia) [X] | Monemvasia and Crete, Greece | 13th–16th century | Not offered: the medieval wine is extinct | — | A sweet Greek wine shipped north by Venice. The drowning of the Duke of Clarence in a butt of Malmsey in 1478 is tradition, made famous by Shakespeare. |
| 21 | Mareotic wine [X] | Lake Mareotis, near Alexandria, Egypt | Ptolemaic to Roman era | Not offered: no wine survives | — | A white wine of Egypt's coast. Horace's Ode 1.37 pictures Cleopatra's mind 'maddened with Mareotic'. |
| 22 | Angelica [X] | California, USA | 19th century | Not offered: style extinct | — | An early California sweet wine made by fortifying unfermented Mission grape juice with brandy. |
| 23 | Liebfraumilch of H. Sichel Söhne (Blue Nun) [N] | Mainz, Rheinhessen, Germany | Brand from 1921; 1930s | Not offered: history panel only | — | The Jewish-owned house of Sichel, founded in Mainz in 1857, built its export trade on Blue Nun. In the 1930s the family dispersed to Britain, France and the US. Peter Sichel returned in 1945 as a US Army officer and found the cellars intact. |
| 24 | Mosel Riesling of the Trier merchant house of Loeb [N] | Trier, Mosel, Germany | Before 1933–1938 | Not offered: history panel only | — | Under Sigmund and Otto Loeb, the house was one of the leading Mosel merchants. The family emigrated to London after 1933, and by 1938 the Jewish wine trade on the Mosel had been destroyed through boycott and forced 'Aryanisation'. |
| 25 | Roman red wine from the Madrague de Giens wreck [S] | Fondi plain, Latium, Italy (wreck off Giens, France) | c. 75–60 BC | Not offered: museum reference (amphora) | 2,085–2,100 | A large merchant ship carrying about 6,000 Dressel 1B amphorae of red wine bound for Gaul. |
| 26 | Heidsieck & Co. Monopole 'Goût Américain' [S] | Reims, France (wreck off Rauma, Finland) | 1907 | A few bottles | 119 | Carried on the schooner *Jönköping*, sunk by U-22 in 1916. The wreck was found in 1997 at about 64 m, and roughly 2,000 bottles were raised. |

## Autumn: The Record and the Ledger

| # | Wine | Region / country | Era / vintage | Lot size | Age in 2026 (years) | Provenance |
|---|---|---|---|---|---|---|
| 27 | Château d'Yquem [F] | Sauternes, France | 1811 | Single bottle | 215 | The best-known of the 'comet vintages', named for the Great Comet seen in 1811–12. Bottles were still being tasted in the late 20th century. |
| 28 | Château Margaux [F] | Margaux, France | 1900 | Single bottle | 126 | The estate records a crop of a size not matched until 1982. The vintage was acclaimed at the time. |
| 29 | Château Lafite: the 'Th.J.' bottles (a provenance lesson) [F] | Pauillac, France | Labelled 1787 | Not offered: reference only (counterfeit) | 239 as labelled; the wine is likely younger | Sold in 1985 as Thomas Jefferson's. Later investigation found modern engraving and no supporting Jefferson record, and the bottles are now regarded as counterfeit. |
| 30 | Bordeaux 'Hermitagé' [X] | Bordeaux and Hermitage, France | Late 18th–19th century | Not offered: practice ended | — | A once-common practice of strengthening claret with Hermitage Syrah, reported at Lafite in 1795 and ended by appellation rules. |
| 31 | Tokaji Aszú [G] | Tokaj, Hungary | 1737 onward | Full case (current release) | — | A 1737 royal decree defined Tokaj as a closed wine region of named towns, one of the earliest such systems. |
| 32 | Arbois Vin Jaune, Antoine Vercel [L] | Jura, France | 1774 | Single bottle | 252 | Harvested under Louis XV and kept by the maker's descendants for eight generations until the last bottles were sold in 2018. |
| 33 | Jerez de la Frontera sherry, Massandra collection [G] | Jerez, Spain (Massandra, Crimea) | 1775 | Single bottle | 251 | One of the oldest bottles in the Massandra collection, which is linked to Prince Lev Golitsyn. |
| 34 | Mount Pleasant, Maurice O'Shea [L] | Hunter Valley, NSW, Australia | 1940s | Single bottle | 79–81 | Small, often single-cask wines such as the 1945 Henri II and 1947 Henri III, from one of Australia's foundational winemakers. |
| 35 | Steinberger Riesling Trockenbeerenauslese, Kloster Eberbach [N] | Rheingau, Germany | 1937 | A few bottles | 89 | 1937 was a major German vintage. The trade sold under maximum prices set by the Reich Price Commissioner, and Trier's 1937s went to auction in spring 1939, shortly before the war. |
| 36 | Erbacher Marcobrunn Riesling Trockenbeerenauslese, Schloss Reinhartshausen [N] | Rheingau, Germany | 1937 | Single bottle | 89 | Michael Broadbent described 1937 as a great vintage in Germany. His notes on this wine run from 1988 to 1997. |
| 37 | Weingut Krems / Sandgrubengut, Robitschek family [N] | Krems, Lower Austria (annexed 1938) | 1938 | Not offered: history panel only | 88 | The Jewish-owned estate was transferred under duress in 1938 and later taken over by the Krems growers' cooperative. A 1949 settlement gave money, not the land, back. The cooperative has published the history. |
| 38 | Roman red wine from the Grand Congloué 2 wreck [S] | Cosa, Etruria, Italy (wreck off Marseille) | c. 110–90 BC | Not offered: museum reference (amphora) | 2,115–2,135 | One of the first wrecks studied with scuba (Cousteau, 1950s). About 1,500 Dressel 1A amphorae, whose residues point to red wine. |
| 39 | Veuve Clicquot Ponsardin, Åland wreck [S] | Champagne, France (wreck off Föglö, Finland) | c. 1841–43 | Single bottle | 183–185 | 46 bottles were among the 168 raised in 2010 from a schooner wreck at about 50 m. Cork markings date them to the early 1840s, and the wine was later analysed chemically (PNAS, 2015). |

## Winter: Endurance and Loss

| # | Wine | Region / country | Era / vintage | Lot size | Age in 2026 (years) | Provenance |
|---|---|---|---|---|---|---|
| 40 | Romanée-Conti [F] | Vosne-Romanée, Burgundy, France | 1945 | Single bottle | 81 | About 600 bottles: the last vintage from the original ungrafted vines, which were pulled up afterwards. The next Romanée-Conti was 1952. |
| 41 | Château Mouton Rothschild [F] | Pauillac, France | 1945 | A few bottles | 81 | Philippe Jullian's 'Année de la Victoire' label with its 'V' began the château's tradition of commissioning an artist for each label. |
| 42 | Schloss Johannisberger Riesling Rosalack Auslese [N] | Rheingau, Germany | 1945 | Single bottle | 81 | A small crop made in a wartime ruin: the Schloss had been bombed in August 1942, and labour, sulphur and glass were scarce. The cellars came through. |
| 43 | Paul Jaboulet Aîné Hermitage La Chapelle [F] | Northern Rhône, France | 1961 | A few bottles | 65 | A low-yield Syrah vintage counted among the great Rhône wines of the century. |
| 44 | Quinta do Noval Nacional [F] | Douro, Portugal | 1931 | Single bottle | 95 | From a small plot of ungrafted vines planted in 1925, declared in the Depression year of 1931. |
| 45 | Château Musar [L] | Bekaa Valley, Lebanon | 1967 (and the war years) | A few bottles | 59 | The 1967 was named the discovery of the 1979 Bristol Wine Fair. Serge Hochar went on making wine through the civil war and lost only the 1976 vintage. |
| 46 | Rutherglen Muscat, Chambers Rosewood [L/G] | Rutherglen, Victoria, Australia | Estate from 1858 | Full case (current release) | — | A gold-rush-era family estate whose solera blends are said to still hold traces of 19th-century wine. |
| 47 | Grand Constance / Constantia [G] | Constantia, South Africa | 18th–19th century | Full case (current release) | — | The sweet Cape wine Jane Austen prescribes for a 'disappointed heart'. Napoleon drank it in exile on St Helena. |
| 48 | Cahors 'black wine' / Kagor [X] | Lot Valley, France (and Russia) | Medieval to 19th century | Full case (current release) | — | A very dark Malbec of the Lot. In Russia it became *kagor*, the Orthodox Church's sacramental wine. |
| 49 | The Speyer bottle (Römerwein) [X] | Roman Germany | c. AD 325–350 | Not offered: museum-held, unique | c. 1,676–1,701 | Found in a Roman tomb in 1867. It is the oldest known unopened bottle of wine and is held at the Historical Museum of the Palatinate in Speyer. |
| 50 | Würzburger Steinwein, Bürgerspital [X] | Franken, Germany | 1540 | Not offered: last full bottle, held by the Bürgerspital | 486 | Hugh Johnson tasted a bottle in London in 1961 and found it still alive. One full bottle remains at the Bürgerspital. |
| 51 | Rüdesheimer, Bremer Ratskeller [L] | Rheingau wine, held in Bremen, Germany | 1653 | Not offered: cask wine, never bottled | 373 | Germany's oldest cask wine, kept in the Ratskeller's Rose Cellar and almost never tasted. |
| 52 | Champagne Juglar, Åland wreck [S/X] | Champagne, France (wreck off Föglö, Finland) | Before 1829 | Single bottle | at least 197 | 95 bottles were raised from the 1840s wreck. The house had stopped trading in 1829, so the wreck preserved bottles from a firm that no longer existed. |
| 53 | Rüdesheimer Apostelwein, Bremer Ratskeller [L/X] | Rheingau wine, held in Bremen, Germany | 1727 | Single half-bottle | 299 (topped-up cask) | Drawn from the 'Judas' cask in the Ratskeller's Apostle Cellar, which has been topped up from time to time with young Rüdesheim wine. It is the oldest bottled wine the Ratskeller still sells, usually in half-bottles. Last bottled in the 1960s. |

---

## Notes for the build

- **German wines, 1933–1945 (#12, 13, 23, 24, 35, 36, 37, 42):** #12, 13, 23, 24 and 37 are history panels, not lots. keep the tone factual. The 1935 campaigns were propaganda as well as sales drives, and their history is tied to the exclusion and dispossession of Jewish growers and merchants. Do not use Nazi-era imagery or slogans on product cards.
- **Disputed stories** are marked in the text as tradition: the Barolo casks, the drowning of Clarence, Napoleon's deathbed request (left out) and the Lafite 'Th.J.' bottles. Keep those labels.
- **Round-number ages:** no verified wine was found whose real age in 2026 is exactly 333 (vintage 1693) or 444 (vintage 1582), so none is listed as such. The very old wines that really exist are the Speyer bottle (c. 1,676–1,701), the 1540 Steinwein (486), the 1653 Bremen Rüdesheimer (373), the 1727 Apostelwein (299), the 1774 Vin Jaune (252) and the 1775 Massandra sherry (251).
- **Left out because they could not be confirmed as wine:** the 1864 *Mary Celestia* wreck bottle opened in 2015 tested at 37% alcohol and may not have been wine.

## Sources

- Weinpatenschaften: https://histrhen.landesgeschichte.eu/2017/02/weinstrasse-versus-weinpatenschaften/ · https://www.volksfreund.de/region/trier-trierer-land/wie-die-nazis-den-wein-von-mosel-saar-ruwer-fuer-propaganda-missbraucht-haben_aid-32872105 · https://www.vinothek-winningen.de/wp-content/uploads/2026/02/Weinkonsum-im-Dienste-der-Volksgemeinschaft.pdf
- Deutsche Weinstraße: https://neustadt-und-nationalsozialismus.uni-mainz.de/glossar/die-gr%C3%BCndung-der-deutschen-weinstra%C3%9Fe-1935 · https://www1.wdr.de/stichtag/stichtag-506.html
- Sichel: https://app.ckbk.com/reference/wine05383c19s001e181/sichel · https://www.telegraph.co.uk/obituaries/2025/03/06/peter-sichel-nazi-germany-blue-nun-liebfraumilch-wine/ · https://www.jewishgen.org/yizkor/Mainz/files/Mainz.pdf
- Loeb and the Jewish Mosel trade: https://juedischemosel.de/wein.html
- Robitschek, Krems: http://www.doew.at/n/d7kur/Arisierung-und-Restitution-der-Kremser-Weingueter-der-Familie-Robitschek · https://www.winzerkrems.at/fileadmin/Bibliothek/WEBSEITE_WINZERKREMS/UeberUns/Geschichte/WinzerKrems_DOEW_endbericht_20200603.pdf
- 1937 vintage and auctions: https://www.vdp.de/en/der-vdp/vdpauctions/the-history-of-auctions · https://www.christies.com/en/lot/lot-3991030 · https://tastingbook.com/wine/kloster_eberbach/stenberger_riesling_trockenbeerenauslese_1937
- Schloss Johannisberg: https://schloss-johannisberg.de/en/history/ · https://www.christies.com.cn/en/lot/lot-3991033
- Jönköping: https://www.heidsieckandco-monopole.com/jonkoping-en · http://news.bbc.co.uk/2/hi/europe/139722.stm
- Åland wreck: https://en.wikipedia.org/wiki/F%C3%B6gl%C3%B6_wreck · https://www.pnas.org/doi/full/10.1073/pnas.1500783112 · https://visitaland.com/en/experience/culinary-aland/discover-alands-historic-beer-champagne-treasures/
- Roman wrecks: https://archeologie.culture.gouv.fr/archeo-sous-marine/en/grand-congloue-experiment · https://archeologie.culture.gouv.fr/archeo-sous-marine/en/madrague-de-giens-archaeology-fieldschool
- Mary Celestia (left out): https://www.reuters.com/article/lifestyle/wine-from-civil-war-era-shipwreck-uncorked-in-south-carolina-idUSKBN0M224R/
- Mouton 1945: https://www.chateau-mouton-rothschild.com/label-art/discover-the-artwork/philippe-jullian
- Romanée-Conti 1945: https://en.wikipedia.org/wiki/Roman%C3%A9e-Conti · https://www.christies.com/en/lot/lot-5435625
- Lafite 'Th.J.': https://www.newyorker.com/magazine/2007/09/03/the-jefferson-bottles
- Yquem 1811: https://en.wikipedia.org/wiki/Comet_vintages
- Margaux 1900: https://chateau-margaux.com/vins/grand-vin-du-chateau-margaux-1900
- Grange: https://adb.anu.edu.au/biography/schubert-max-edmund-27126 · https://www.wineaustralia.com/whats-happening/stories-of-australian-wine/may-2016/penfolds-australian-wine-evolution
- Judgment of Paris: https://www.si.edu/object/nmah_1297104 · https://www.si.edu/object/1973-chateau-montelena-chardonnay%3Anmah_1297105
- Dom Pérignon 1921: https://en.wikipedia.org/wiki/Dom_P%C3%A9rignon
- Biondi-Santi: https://www.biondisanti.it/en/prodotti/vini/7/vini/79/brunello-di-montalcino
- Noval Nacional: https://www.quintadonoval.com/en/history/our-history
- Inglenook: https://www.winespectator.com/articles/inglenooks-winemaking-legacy-6321
- La Chapelle 1961 / Cheval Blanc 1947: https://www.decanter.com/learn/wine-legend-jaboulet-la-chapelle-1961-369886/ · https://www.decanter.com/learn/wine-legend-chateau-cheval-blanc-1947-369917/
- Vega Sicilia: https://english.elpais.com/elpais/2014/07/31/inenglish/1406809820_486774.html
- Barolo: https://marchesibarolo.com/en/history · https://langhe.net/en/wines/barolo-docg/
- Château-Grillet: https://chateau-grillet.com/en/the-estate/
- Klein Constantia: https://www.decanter.com/learn/wine-legend-klein-constantia-vin-de-constance-1986-316130/
- Grand Constance: https://grootconstantia.co.za/grand-constance/ · https://winemag.co.za/wine/opinion/sa-wine-history-napoleons-favourite-cape-wine-and-did-it-kill-him/
- Tahbilk: https://www.tahbilk.com.au/tahbilk-iconic-wines
- Mount Pleasant: https://adb.anu.edu.au/biography/oshea-maurice-george-11317
- Rutherglen: https://www.chambersrosewood.com.au/history
- Musar: https://en.wikipedia.org/wiki/Chateau_Musar · https://www.decanter.com/features/the-magic-of-musar-248198/
- Qvevri: https://ich.unesco.org/en/RL/ancient-georgian-traditional-qvevri-wine-making-method-00870 · https://pmc.ncbi.nlm.nih.gov/articles/PMC5715782/
- Commandaria: https://apnews.com/article/cyprus-commandaria-wine-vineyards-wineries-e949576d95915066284b6b56df952e57
- Tokaj 1737: https://ives-openscience.eu/5121/
- Massandra: https://www.decanter.com/wine-news/wine-auction-sales-exceed-expectations-in-2001-108557/
- Vin jaune 1774: https://www.theguardian.com/lifeandstyle/2018/may/10/french-familys-last-three-bottles-of-1774-wine-up-for-auction
- Madeira: https://www.mountvernon.org/library/digitalhistory/digital-encyclopedia/article/madeira
- Opimian / Falernian: https://www.perseus.tufts.edu/hopper/text?doc=Perseus%3Atext%3A1999.02.0137%3Abook%3D14%3Achapter%3D16
- Mareotic: https://en.wikisource.org/wiki/Translation:Odes_(Horace)/Book_I/37
- Sack: https://app.ckbk.com/reference/wine05383c19s001e005/sack
- Malmsey: https://en.wikipedia.org/wiki/Butt_of_malmsey
- Hermitagé: https://www.chateau-palmer.com/en/article/charles-palmers-claret
- Angelica: https://winehistoryproject.org/angelica/
- Cahors / Kagor: https://www.gw2ru.com/russian-kitchen/3043-cahors-wine-from-france-kagor-orthodox-church-wine
- Speyer bottle: https://en.wikipedia.org/wiki/Speyer_wine_bottle
- Steinwein 1540: https://www.buergerspital.de/wineestate/1540-steinwein/index.html
- Bremer Ratskeller: https://www.ratskeller-bremen.de/en/wir/geschichte/ · https://ratskeller.de/ratskeller-entdecken/schatzkammer/
- Apostelwein 1727: https://tastingbook.com/wine/bremer_ratskeller/apostelwein_1727 · https://www.vinositas.com/1727-rudesheimer-apostelwein/ · https://www.christies.com/en/lot/lot-4634004

Appendix: Sources

• /workspace/vale-estate-git/VALE-ESTATE-BUILD-PROMPT.md (§0, §0A, §1, §3, §5 to §12)
• /workspace/vale-estate-git/SITE-SPEC.md, CELLAR-LIST.md, README.md; git commits 937df0e and 76db8e9
• /workspace/team/prompts/Vale-Keeper.md lines 5, 7 and 10 (Vale Keeper prompt)
• /workspace/spearfish-brand/customer/ABOUT-SPEARFISH.md line 21
• Voice call a4e4073b, 19 Oct 2026, started 01:08 AEST (Vale description; codex applied)
• Voice call c8d7fc84, 18 Oct 2026, started 03:53 AEST (War Room is the Vale Estate viewing platform; the doom board is the developer dashboard)

• Voice calls f2141e25 and b17f1de9 (codex name; non-forceful application)

• /workspace/vale-estate-git/brand/ icons; /workspace/spearfish-marketing/DESIGN-FROM-CODEX.md

• Book II source: /workspace/codex-v3-illustrated/living-veca-symmetry-codex-v3-illustrated.pdf (79 pages, 28.2 MB, 19 Oct 01:41 AEST)