LessonLoop

Double bookings, float money, and tenants who must never see each other — the three ways a school platform fails, all three usually handled in application code that a bug can skip.

Multi-tenant Postgres with row-level security enforced in the database itself: 142 tables, 277 policies with FORCE RLS and restrictive deny-all layers, and 79 authorisation helpers held in a private schema the API physically cannot reach. Exclusion constraints make double-booking structurally impossible under concurrency.

Money is Stripe Connect destination charges with two-phase idempotent webhook processing; every amount an integer in minor units, by constitutional rule.

The iOS app is native Swift: a credential-free widget fed through an App Group, Live Activities whose countdown the OS itself draws, StoreKit 2 purchases resolved to the right tenant server-side.

2,032 automated tests, 1,012 of them adversarial: they impersonate all five roles at the database level, attack across the tenant boundary on every table × role × operation, and roll back through a sentinel exception. A suite that skips is a hard failure, never a green tick.

A forty-week recurring series with three clashes books 37 lessons and honestly reports three skipped.