Offline-first mobile inspection app for Nordic real-estate consultants

Cross-platform via Expo + Legend-State v3. Expo SDK 52 managed workflow + React Native 0.76.5 + TypeScript + Expo Router (typed routes) + NativeWind. Legend-State v3 with syncedSupabase provides an observable store that is also a mutation queue – writes land in the local store immediately and drain to Supabase in background, with expo-background-task keeping the drain alive even if the app is backgrounded. The field consultant's record is the record because the mutation queue preserves local writes until Supabase confirms them.

Multi-tenant Postgres RLS enforced on firm_id. Nine tables and three storage buckets, all with per-row RLS tied to the authenticated user's firm_id. pgTAP boundary tests are mandatory before merge: if a change to a policy would let one firm read another firm's rows, the test fails and the PR is blocked. The RLS boundary holds even though the mobile app is a Supabase client – the database refuses the cross-firm read regardless of who's asking.

Signed PDF reports via Trigger.dev + @react-pdf/renderer. A single named task generate-inspection-report renders the husleieloven template to a PDF, uploads to Supabase Storage, and returns a signed URL. Max duration 300 s, 3 retries with exponential backoff. Keeping PDF generation server-side means legal templates live in one place, versioned.

Monetisation outside the app. The app only authenticates (Supabase magic-link). Subscription is sold via the Next.js marketing site at knokko/marketing/, scaffolded with legal placeholders + delete-account surface. No StoreKit, no Google Play Billing, no consumer subscription UI inside the app – which keeps a mobile B2B product out of the 30% Apple IAP tax, out of the Sign-in-with-Apple requirement, and out of the "subscription for a tool our employer pays for" UX trap.

Alternatives considered and rejected:

• Native per platform. Two codebases is twice the maintenance for a two-person shop. Legend-State + Expo covered the hard parts (camera, offline sync, resumable upload) convincingly enough that this never got close.
• CRDT merge for offline. The business rule is "the consultant on-site is right"; a merge strategy that lets a sync pull overwrite a field write would violate the invariant. Mutation queue with last-write-wins (where last = the physical consultant) is the honest model.
• Flutter. Would have worked. Rejected on team-skills grounds; the Portfolio's React depth transfers directly to RN.
• Apple IAP for subscription. 30% tax + the IAP tax reaches B2B tools too + Sign-in-with-Apple requirement + consumer-UX disclosures. All of that for a SaaS the firm's finance team was going to pay by invoice anyway.
• US Supabase region. CLAUDE.md forbids it: EU residency (Frankfurt or Stockholm) is a hard constraint for the kind of data this app handles.

• Full offline-first write path, demonstrated end-to-end. Property list, room/checklist CRUD, two-party signature capture, photo capture, and the photo upload queue all go through Legend-State observables with Supabase as the sync destination. expo-background-task keeps the queue draining when the app is backgrounded. Not a mock; verified on a photo-heavy write surface.
• TUS resumable uploads for photos > 6 MB. Inspection photos run large; a flaky signal with a 20 MB photo on a 3G link would fail a plain POST. TUS resumability turns a failed upload into a resumed one.
• pgTAP boundary tests on every RLS-touching PR. The tests cover firm_id isolation on 9 tables + storage buckets. A boundary regression fails CI; a security reviewer agent pass is required on every auth / RLS / signature / photo change.
• Expo-camera + photo compression + metadata stripping. Photos are captured through expo-camera, compressed before enqueue, and stripped of GPS EXIF – the client doesn't need to know whose home was photographed.
• i18n with Norwegian as source. nb-NO is the source language; sv-SE, da-DK, and en are downstream drafts awaiting paid native review. Inverts the usual Nordic-product mistake of writing English first and treating NO as a translation.
• Autonomous build cadence via Fleet backlog. Cycle 6 (primitives + feedback + confirm pair + flicker + token) delivered 8 PRs in one session on 2026-10-04 against a knokko Fleet-backlog project. Button, ScreenHeader, MutationErrorBanner, useMutationFeedback, ConfirmSheet, plus two UI fixes – all merged in one bundled cycle.

• pgTAP boundary tests on 9 tables + 3 storage buckets passing on every PR; a firm_id leak fails the pipeline.
• End-to-end offline test (manual, airplane mode): property list → room CRUD → signatures → photo capture → background upload after reconnect. Mutations survive the gap, upload queue drains correctly.
• Trigger.dev generate-inspection-report task validated against the husleieloven template with sample data; 300 s / 3-retry envelope exercised on an intentionally-slow render.
• Security-reviewer agent pass required on every auth / RLS / signature / photo change per workspace rule. Catches include EXIF-GPS removal, signed-URL expiry, and storage-bucket policy drift.

1. Offline-first mobile write path on React Native – Legend-State v3 syncedSupabase observables, mutation queue, expo-background-task drain, verified end-to-end on photo writes.
2. Multi-tenant Postgres RLS enforced on firm_id with pgTAP gates – security-first before the first paying customer. The boundary holds even against the client-side Supabase client.
3. Expo + EAS Build + typed Expo Router – one codebase, two platforms, type-safe routes, EAS pipeline for Build + Submit.
4. Mobile B2B monetisation without StoreKit / Play Billing – subscription on the marketing site; app only authenticates; no 30% tax, no Sign-in-with-Apple requirement.
5. Server-side signed PDFs via Trigger.dev – single named task, @react-pdf/renderer, Supabase Storage signed URL; legal templates versioned in one place.
6. EU-first data residency as a hard rule – Frankfurt or Stockholm; US regions forbidden by workspace rule. Not a marketing claim, a CLAUDE.md guardrail.
7. Norwegian-source i18n – NO as source, SE / DK / EN downstream drafts awaiting paid native review.

1. For a mobile B2B tool, sell the subscription outside the app. The 30% Apple tax, the Sign-in-with-Apple requirement, and the consumer-subscription UX pattern are all costs that evaporate the moment payment lives on a marketing site your buyer was going to use anyway.
2. If the mobile app is a Supabase client, the RLS boundary is your only real tenancy guarantee. Trust-the-client is not a model; firm_id RLS with pgTAP gates on every merge is.
3. Pick the sync model that honours the business rule, not the one with the nicest conflict story. "The on-site consultant is right" rules out CRDT-merge; a mutation queue with last-write-wins fits the invariant.
4. Legal artefacts belong on the server from day one. The husleieloven PDF is the thing a judge might read; it should be a tested server-side task before any UI touches it. (Still fixing this one on Knokko.)