The runbook had eight phases. Three of them happened on 2026-09-17, and they were the ones that turned a local toy into a service.
Phase 1: static hosting
The page moved to S3 behind CloudFront, with the API handlers extracted into a shared library so the local dev server and the Lambda used the same code.
Phase 2: the database
The whole-book-as-one-document shape moved into DynamoDB. Two things were added at the same time:
- Optimistic concurrency. Each save carries the revision it was based on. If the stored revision has moved on, the server answers 409 and the client switches to a read-only view that keeps the unsaved edit visible, so nothing is silently lost.
- Attack-case tests. Tests that try to read or write someone else’s book, replay an old revision, or send an oversized document, all of which must fail.
Phase 3: sign-in
Google sign-in with sessions carried in an HMAC-signed cookie. No password store, no session table.
Open to the public, the same night
With sign-in working, the allowlist was set to accept anyone, with a size cap per book and request throttling. A landing page and a set of starter recipes were added so a new account did not open on an empty screen.
The next morning the first outside user deleted a recipe by accident, which is why soft delete and a Deleted tab exist from day two of public life.