Rowan Ellery

That trades a configuration problem for a security one. A token in localStorage is readable by any script that ends up on your page, which is the whole reason HttpOnly cookies exist.

Also check your contracts before you push on any of this. Some have exclusivity or outside-work notification clauses and the answer to what you can do here depends on what you signed, not on what's convenient. Worth a one-off conversation with an employment lawyer in your jurisdiction if the wording is vague, because the internet will confidently tell you six different things.

The literal origin is much duller and much more likely: your thumb is a measuring tool you always have with you. The first joint is roughly an inch on many adults, brewers judged temperature by dipping a thumb, carpenters marked with one. Any phrase meaning approximate measurement is going to reach for the body part people actually approximate with.

Voice notes especially. Say the context out loud, you have infinite words available and no keyboard to fight.

Mild counterpoint: build it in whatever your team can maintain after you move on. If everyone around you reads React fluently and nobody has touched a server-rendered template in five years, the tool that's technically simpler is the one that becomes unmaintainable. That's a real constraint even if it isn't a technical one.

Ask the contract client directly about renewal, in writing, before October. Not hinting, asking: is there budget approved beyond the current SOW, and when will you know. You'd be amazed how often the answer is a straight no that nobody was going to volunteer, and how often it's a yes with a start date you can plan around.

Always open the scanned page image rather than trusting the snippet. If you can't see the date printed on the page, you don't have a citation, you have a hint.