ChronoCare Pro routes every watch through a deterministic pipeline. Each shop's data is sealed per subdomain. The milestone engine fires events that compose into the permanent Digital Service Record on completion.
Every request is scoped to a tenant resolved from subdomain. Database queries are partitioned by tenant_id with row-level enforcement. No shared query path exists.
request → resolveTenant(subdomain)
↓
middleware.attachTenantId(req)
↓
db.query.where({ tenant_id }) // enforced
↓
response (tenant-scoped)A state machine governs allowed transitions. Every change emits an event consumed by the messaging, notification and DSR builders.