Tetsu Kasuya’s 4:6 method, one variable per brew. App and API on the same Worker, data in D1, photos in R2, session on an HttpOnly cookie; and the same build, packaged as an Android app with its own native plugins.
The rule of the experiment is to change exactly one variable between brews and watch what happens; the software exists only so that rule can be kept. The server computes what it can compute — the pour schedule scaled from recipe and actual water, the ratio, the days off roast — and the client sends none of it: if it did, two logs would eventually disagree.
App and API sharing an origin is not cosmetic: it removes CORS at the root, and it is what allowed moving the token out of `localStorage` and into an `HttpOnly`, `SameSite=Strict` cookie. JavaScript can no longer read it, so an XSS does not walk off with the token, and another site cannot trigger a write from your browser. With no secret configured the Worker fails closed: it authorises nobody.
The native app is not a second app: it is the same Nuxt build inside Capacitor, with three Kotlin plugins for what the web cannot reach. The brew timer lives as an ongoing notification on the lock screen, and the reminder to rate the cup is an alarm-clock alarm, because a regular exact alarm arrived up to 48 seconds late under the vendor’s battery saver.