System Architecture Overview

Legend

Layer	Color	Meaning
1 — Domains	Soft blue	What users type. `party.` 301-redirects into `hub.`
2 — Projects	Soft green	Cloudflare Pages projects. Both static.
3 — Sections	Soft violet	Top-level paths inside each project.
4 — Roles	Soft amber	Soft-fenced via `/auth/gate.js`. Owner / member / viewer.
5 — Data	Soft terracotta	Where state actually lives. KV is the only mutable store; everything else is static JSON.

Layer 1 → Layer 2: a domain points to exactly one project. hub. and party. both resolve to substrate (party. via 301 redirect rule).
Layer 2 → Layer 3: each project contains sections. The website project holds / (landing) and /manage (PWA). Substrate holds the rest.
Layer 3 → Layer 4: roles only apply inside surfaces that gate (e.g., /cece/rainhairstudio/ uses owner/member/viewer). Public pages like / and /manage have their own auth (PRESET_ACCOUNTS / Firebase Auth).
Layer 5: KV namespace = OUR_HUB_DATA (binding env.OUR_KV). /data/*.json = repo-committed static data files. _data/*.json = per-feature data inside a section (e.g., /cece/rainhairstudio/_data/). The _ prefix signals "data, not pages" but does not enforce privacy.