One product, five domains, three platforms

People log sets in gym basements and scan barcodes in supermarket aisles — two of the places phone signal is worst. Offline could not be a degraded mode. Most apps that claim offline support mean they cache reads; here every write path — habits, workouts, nutrition, calendar, social, challenges, profile and settings — goes through a durable mutation queue in device storage, replayed on reconnect. Around 46 job handlers are registered across the feature modules. Nothing fails because the network is gone; it queues.

The hard part is replaying honestly. Creates carry client-generated identifiers, so a replayed insert that collides with an existing row counts as success. Inverse pairs cancel before they reach the server — a like followed by an unlike is no request at all. Deleting a post that never synced purges the comments and likes queued against it. Challenge increments sum locally, because the underlying call applies a delta and is not safe to repeat.

A crash we had to earn our way out of

Early builds terminated on iOS under heavy interaction. The crashes surfaced as watchdog terminations, which tell you almost nothing on their own. Correlating them with touch-burst breadcrumbs pointed at cache invalidation: a global invalidate was firing on every queue drain, re-rendering the whole tree.

The fix: each queued job declares which query namespaces it touches, invalidations coalesce into a single pass, and static keys are never touched. Same correctness, a fraction of the work, and the terminations stopped.

74 migrations, roughly 52 tables and around 60 Postgres functions, with row-level security on every table. Several migrations exist purely to fix policy recursion and tighten the trust boundary — security-definer helpers to break recursive policies, escaping on user search, and revoked grants on functions that did not need to be callable.

The part worth stealing: subscription entitlements derive from two timestamp columns on the user row, and the same derivation runs in the client and inside the row-level security policies. Free-tier limits are a server-side backstop, not a client-side courtesy — and entitlement checks work offline, because the client computes from data it already holds using identical logic.

The web build initially scored 54 on mobile PageSpeed, with a largest contentful paint of 11.3 seconds. It now paints at 0.6 seconds locally — from four specific changes, not general tidying:

• A splash screen in pure CSS, hidden by a sibling selector once the app root fills — no JavaScript, because the content security policy forbids inline scripts.
• Font stylesheets fetched at build time and inlined, so no font request blocks first render.
• The payments SDK — 767 KB on its own — moved behind a dynamic import.
• Session-replay modules stubbed out of the web bundle entirely.

Entry bundle fell from 6.93 MB to 6.00 MB. On Android, release builds are minified and restricted to ARM ABIs, taking the shipped bundle from 108.6 MB to 68.2 MB. On device, long lists are windowed manually, per-keystroke state writes are debounced, and so are connectivity changes, so a signal blip cannot trigger a refetch storm.