With the apps merged, the iOS app got rebuilt around live data - ~25 screens that had been faking it with mock data got wired to real endpoints across four workspaces. And checkout stopped kicking people out to a browser: native in-app Stripe payments across cart, dive days, travel, and rentals.
The gremlin of the week was tenancy. We turned on row-level security across every shop_ table, and then spent a while chasing rows that were silently disappearing - inserts landing with a NULL shop_id, invisible to the very security policy meant to protect them, while the admin views (which bypass the policy) cheerfully still showed them. The kind of bug where everything looks fine until it very much is not.
Shipped
- Folded the standalone service surface in as the merged app's 5th section
- iOS rebuilt on live data: four-workspace shell, ~25 real screens, mock data deleted
- Native Stripe PaymentSheet across four flows - checkout never leaves the app
- Row-level security across all shop_ tables - plus the fix for inserts landing as NULL shop_id and going invisible
- Page-by-page access control via a single /v1/contacts/me contract; closed several access holes on the way
- Contact merge for the CRM: dry-run preview → transactional execute → reversible undo, because a merge you cannot take back is a loaded gun