Tetsu Kasuya’s 4:6 method, one variable per brew. App and API on the same Worker, data in D1, photos in R2, session on an HttpOnly cookie.
The rule of the experiment is to change exactly one variable between brews and watch what happens; the software exists only so that rule can be kept. The server computes what it can compute — the pour schedule scaled from recipe and actual water, the ratio, the days off roast — and the client sends none of it: if it did, two logs would eventually disagree.
App and API sharing an origin is not cosmetic: it removes CORS at the root, and it is what allowed moving the token out of `localStorage` and into an `HttpOnly`, `SameSite=Strict` cookie. JavaScript can no longer read it, so an XSS does not walk off with the token, and another site cannot trigger a write from your browser. With no secret configured the Worker fails closed: it authorises nobody.