Every flow, end to end

1. The customer buys as normal. No number is mentioned, and none is set aside.

   We record nothing yet. There is no chapter record for an order that has not been packed.

2. Payment and fraud checks clear. Shopify tags the order as ready to pack.

3. The warehouse starts packing. Shopify asks us for a number, and gets the lowest free one in the open chapter.

   We record the number as reserved against that one order line, with the time and who asked.

4. The engraver takes a caseback and a coin, engraves the same identity on both, photographs them, and seals the pair in one pouch.

   We record both engraved parts and the pouch they went into.

5. A different person checks the two engravings match, then the watch is boxed with its certificate and a sealed card carrying the claim code.

   We record who checked it, the photographs, and that a claim code was issued. We keep only a scrambled copy of the code itself.

6. The parcel is handed to the courier and Shopify creates the shipment.

   We record the number as permanently used. The watch becomes visible on the public registry for the first time.

7. The customer gets an email with their collection, chapter, number, full serial and a link to their record.

1. They scan the QR on the coin, or type the serial from the certificate into the registry page.

2. They see the collection, the model, the chapter and number, the month it shipped, and its current status.

   We record nothing about them. They never see a name, an address, an order number or a price — and the page source does not contain them either.

3. If the watch has been reported lost or stolen, the page says only: contact CZARD before any transaction involving this watch. It does not publish the incident.

4. If nothing matches, they get one message — the same one for a typo, a fake serial, and a real watch that has not shipped yet.

   We record nothing. Different answers would tell a counterfeiter which serials are real and which are still to come.

1. The owner opens the claim page and enters the serial plus the code from the sealed card in the box.

2. They add an email or a phone number, so a future sale can be verified.

   We record a private owner record. Nothing about it appears on the public page.

3. The code stops working the moment it is used. There is no way to reissue it to someone else.

1. The current owner starts a transfer and receives a one-time code to hand to the buyer.

   We record the refusal, if there is one. A transfer is blocked while the watch is flagged lost or stolen, or has an open service case.

2. The buyer enters the code and their own contact details.

3. The old owner record is closed and a new one opens. The serial, the chapter and the number are untouched.

   We record the new owner, and we kill the original claim card in case it is still in the box.

The console has a checklist for this: tick what is true of the parcel in front of you and it gives you the row — the same row support reads to the customer, so the two can never disagree.

1. If the original engraved parts come back to us and are destroyed under witness, the replacement carries the exact same serial.

   We record the destruction, the technical report and who approved it.

2. If they cannot be recovered, the replacement is engraved 127 / 500 · R1 and the original is blocked.

   We record the link between the two. The registry shows that an authorised replacement exists.

1. A carrier investigation opens and the number is flagged straight away. It does not go back into stock while the outcome is unknown.

2. Once loss is confirmed, the number is blocked permanently and a replacement is issued under the warranty rules above.

   We record a critical problem against whoever asks, if anyone later tries to reuse it. The system refuses the move.

3. If the original later turns up, it goes to authentication — never quietly back onto the shelf.

4. For as long as it is flagged, nobody can transfer it to a new owner without a person reviewing it.

1. The warehouse lead releases the next 25 numbers into the engraving queue and prints the pouch labels.

   We record which numbers went out. On the label: the serial, the chapter, the number and a checklist. Nothing about the customer.

2. The engraver puts the same identity on the caseback and the coin, and photographs both at a fixed station.

3. A second person checks the text, the sequence, the collection, the orientation and the finish.

4. The matched pair goes into one sealed pouch, marked ready.

1. The packer scans the order, and the system reserves the lowest ready number for it.

2. They scan the watch, the pouch, the coin and the certificate.

   We record every scan. The system blocks completion unless all four carry the same identity.

3. The caseback is fitted and any water-resistance check is done.

4. QC does the final look, the serial match, and the photograph of the whole set.

5. The box is sealed with the claim card inside. The shipping label stays locked until QC has passed it.

1. The supervisor scans the sealed parcel against the courier manifest.

2. Shopify creates the shipment with tracking.

3. The number becomes permanently used, and the public record goes live at that instant.

   We record the handover. A watch still in the building has no public record at all, so the registry can never be used to see tomorrow’s numbers.

4. The customer’s email goes out with the chapter, the number and the registry link.

5. At end of day, check that no packed parcel is missing a shipment and no shipment is missing a number.

1. Scan the parcel before opening it, and film the opening for anything high-value.

2. Scan the caseback, the coin, the certificate and the watch.

3. Check the registry for the claim status, any service history, and any lost or stolen flag.

4. Classify it: sealed and perfect, opened but unworn, worn or claimed, damaged, mismatched, or suspected fake.

   We record the classification, once it is made. Do not change the status or decide how it will be resold until QC is finished.

5. Putting it back into stock needs a supervisor, and the number stays with this watch.

1. Pick the type from the list, name the watch if it is about one, and say what happened.

2. The console shows the immediate action for that type and who owns it.

3. A critical one stops the line. Duplicate serials, a coin and caseback that disagree, a watch shipped with no number, an attempt to reuse a lost number, a customer reporting a duplicate, or personal data appearing on the public page.

4. Closing it needs a written note.

   We record what was actually done. At end of day, read the closed ones too, not just the open ones.

1. Run each scenario from the console: everything goes right, cancelled before engraving, coin and caseback disagree, came back unopened, lost by the courier.

2. Each run drives a real order through the real system.

   We record all of it, exactly as if it were a customer order. A practice run against a pretend system only tells you the pretend system works.

3. Do not open sales until twenty in a row finish with nothing unexplained.

1. Before you open. Check the five safety conditions on the control room screen. If any one has failed, do not open sales.

2. Confirm 25 matched sets are ready and that the physical count agrees with the screen.

3. Push one live zero-value order all the way through, then cancel it.

4. First four hours. Count up every thirty minutes. Stop shipping the moment a duplicate, a mismatch or a missing record appears.

5. Keep what the customer is told conservative: the chapter is open, and that is all.

6. End of day. Export the snapshots, count what is left, review every problem including the closed ones, and publish nothing celebratory until the figures agree.