Every store gets its own isolated, branded league
A single codebase serves an unlimited number of stores. Each league is fully isolated — its own players, scores, settings, logo, and admin password — routed by slug at /[slug]. This is the backbone that makes a per-store retail product possible: one deploy, one bill, every store a tenant.
Organized Play only works if a game shop can run its own event without us in the loop. But standing up a separate site, database, or deploy for every store that stocks High Noon does not scale — it is a support and cost sinkhole before the first ten stores sign on.
At the same time, stores cannot share a namespace. Store A must never see, edit, or overwrite Store B's players or scores, and each store needs its own branding and its own admin credential. A naive shared table would leak data across tenants and make a single fat-fingered admin able to wreck a neighbor's tournament.
The engine has to be genuinely multi-tenant from day one: cheap to run at scale, hard-isolated per store, and self-routing so a new league is a row of data, not a new deployment.
One codebase, unlimited tenants, zero cross-contamination.
Every league lives under its own slug at /[slug]. The slug is the tenant key end to end — public board, TV view, and admin all scope every read and write to that one store.
Players, scores, settings, logo, and prize text are namespaced per slug in the data layer. A store's admin can only ever touch its own keys — there is no query path from one league into another's data.
Each league carries its own admin password. Authenticating into one store's console grants nothing on any other store. Compromise or a shared laptop stays contained to the single tenant.
The engine is live in production; these are the milestones behind it and what still hardens it.
Origin: Organized Play needs every store to run its own event without a per-store site or deploy. Built as the foundation of the whole platform.
Prereqs: None outstanding — slug routing, per-tenant data isolation, and per-store auth are all live.
Status: Live in production and proven under real event load. E3 (self-serve provisioning, collision guards, audit trail) layers on as the product opens to stores.
Internal strategy page. Keep this honest as the build changes.