security: harden PR and code-scanning controls

.github/workflows/dependency-review.yml

@@ -0,0 +1,25 @@
+name: Dependency review
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: low
+          fail-on-scopes: runtime, development, unknown

docs/README.md

@@ -18,6 +18,15 @@ guidance, not medical advice or a substitute for ADHD assessment or treatment.
   records screenshot- and implementation-backed usability findings, prioritized
   safety and accessibility issues, proposed interaction requirements, validation
   scenarios, and a staged optimization plan.
+- [Day-transition and achievement-closing inspiration](day-transition-and-closing-inspiration.md)
+  preserves experiential input about small ritual boundaries, acknowledging
+  progress and effort, and carrying one concrete next action into the following
+  day without turning Close into a score, streak, or second task manager.
+- [Japanese work and cultural practices: product inspiration](japanese-work-and-cultural-practices-inspiration.md)
+  evaluates Kanban/pull, *genchi genbutsu*, pointing and calling, 5S,
+  Kaizen/Improvement Kata, jidoka/poka-yoke, and *ma* against Timemanager's
+  low-friction product and evidence boundaries, with first-party and academic
+  references.
 - [Task detail and complex-work requirements](task-detail-and-complex-work-requirements.md)
   defines the Phase 1 task-detail, component, lightweight-project, ordering,
   dependency, external-waiting, readiness, and Today-placement contracts.

docs/day-transition-and-closing-inspiration.md

@@ -0,0 +1,147 @@
+# Day-transition and achievement-closing inspiration
+
+Status: product inspiration; not implemented or participant-validated
+
+Recorded: 2026-08-31
+
+Evidence label: Experiential — user-provided lived-experience input
+
+## Purpose
+
+This note preserves additional input for the proposed Transition, Close,
+Review/Reset, focus-outcome, and history experiences. It does not change the
+canonical milestone order, establish an implementation decision, or provide
+evidence of clinical effectiveness.
+
+[Japanese work and cultural practices: product inspiration](japanese-work-and-cultural-practices-inspiration.md)
+adds referenced research on Kanban/pull, *genchi genbutsu*, pointing and
+calling, 5S, Kaizen/Improvement Kata, jidoka/poka-yoke, and *ma*. Their proposed
+Timemanager translations remain product hypotheses rather than validated ADHD
+interventions.
+
+## Lived-experience signal
+
+A forward-looking task system makes unfinished work and future challenges highly
+visible. Completed work, partial progress, recovery after difficulty, useful
+decisions, and other forms of effort can be much easier to forget. The resulting
+view may show the mountain ahead while obscuring the ground already crossed.
+
+An intentionally small closing reflection could help balance that view by
+preserving what happened and acknowledging that the day's effort is finished.
+
+> The plan shows what remains. The close preserves what happened.
+
+## Closing acknowledgement
+
+The Japanese expression **今日も一日お疲れ様** (*kyō mo ichinichi
+otsukaresama*) was supplied as inspiration for this boundary. Its approximate
+sense in this context is: *Good work today; you've worked hard today.*
+The useful product idea is not that every user should adopt this exact phrase.
+It is that the product may offer a user-chosen acknowledgement that today's
+effort has been seen and the day can end.
+
+A possible optional Close flow is:
+
+1. **What did you move forward today?** Select or write no more than three
+   acknowledgements.
+2. **What helped, even if it was not completed?** Optionally record progress,
+   effort, recovery, a decision, asking for help, deliberate rest, or making
+   tomorrow easier.
+3. **Tomorrow I start with:** Save one concrete, user-confirmed next action.
+4. Show the user's preferred short closing acknowledgement.
+
+Achievements must not be limited to completed tasks. Starting difficult work,
+making partial progress, recovering after losing focus, responding to an
+interruption, making a decision, reducing an unrealistic plan, or deliberately
+stopping can all be legitimate acknowledgements when the user chooses them.
+
+The initial product hypothesis is that this should take about 60 seconds and
+remain useful even when the only acknowledgement is "I kept going" or "I made
+tomorrow easier."
+
+## Day-boundary rituals
+
+The same principle may extend to transitions between parts of the day. Each
+boundary combines a cognitive handoff with one to three user-chosen physical or
+environmental cues.
+
+| Boundary | Cognitive handoff | Example user-chosen cues |
+| --- | --- | --- |
+| Start day | **Today:** what matters? **First:** how do I begin? | Open curtains, move briefly, make tea |
+| Lunch | Where is work safely parked? | Clear the desk, wash hands, eat elsewhere, take a short walk |
+| End work | What moved? Where exactly do I resume? | Save the next action, close applications, change the environment |
+| Before bed | What should be acknowledged, and what would make morning easier? | Prepare one item, choose a quiet activity, close the day |
+
+The examples are inspiration, not a prescribed routine. Ritual steps should be
+user-authored or explicitly selected, culturally adaptable, editable,
+reversible, and skippable.
+
+## Product constraints
+
+- Keep each transition deliberately small; do not create a checklist marathon.
+- Do not require journaling, inbox zero, a complete review, or an impressive
+  achievement.
+- Do not add scores, grades, streaks, productivity comparisons, routine debt,
+  or failure language.
+- Do not infer an achievement, effort level, emotional state, or meaning from
+  task data. The user decides what deserves acknowledgement.
+- Suggestions may use visible facts such as tasks the user completed today, but
+  nothing is recorded until the user confirms it.
+- Saving a next action must not silently complete, schedule, promote, reorder,
+  or roll over a task.
+- Low Capacity should reduce the experience to one optional acknowledgement or
+  one anchor action, with an immediate exit.
+- The phrase, language, and ritual framing must be optional and localizable.
+- A missed or deferred Close must not block tomorrow's plan or create a warning.
+
+## Relationship to existing concepts
+
+- **Today highlight** can provide the proposed morning **Today** intention.
+- A task's saved **next action** can provide **First** and **Tomorrow I start
+  with**, subject to explicit confirmation.
+- Existing completed-today tasks may be offered as acknowledgement candidates,
+  but they are not the only valid achievements.
+- **Remember** remains a separate three-item transient cue list. It must not be
+  repurposed as an achievement history or daily journal.
+- Existing reflection markers may eventually annotate a user-confirmed outcome,
+  but they must not replace the plain acknowledgement or make Close feel like a
+  questionnaire.
+
+If a future implementation persists daily closing records, they become private
+user-authored data. Before implementation, define account ownership, stable
+identity and revision semantics, correction and deletion, retention, account
+export/import, migration behavior, and recovery. Do not store this content only
+in browser state without a deliberate privacy and interruption-recovery
+decision.
+
+## Roadmap relationship
+
+This input may inform several existing milestones without changing their order:
+
+- **1.3 Review and consequence-aware Reset/recovery:** distinguish balanced
+  acknowledgement from backlog review and scoring.
+- **1.4 Fixed commitments and transition boundaries:** test optional ritual
+  cues at start, lunch, work close, and bedtime boundaries.
+- **1.6 Bounded focus-session record:** allow a user-confirmed progress and
+  next-action outcome when stopping or switching.
+- **1.7 Last Done and execution history:** reuse compatible privacy, correction,
+  reflection, and export contracts without conflating an achievement
+  acknowledgement with an activity execution.
+
+The outstanding validation interlock and existing milestone sequence remain
+authoritative. This note is discovery input for prototypes and requirements,
+not authority to implement persistent behavior.
+
+## Questions to validate
+
+- Does the Close feel like acknowledgement rather than another review burden?
+- Can a participant complete or skip it comfortably in about 60 seconds?
+- Do incomplete progress and recovery feel as legitimate as task completion?
+- Does the closing acknowledgement make stopping feel more deliberate without
+  creating dependency on the application?
+- Does a concrete next-start handoff reduce reconstruction effort the following
+  day without silently deciding the new Today plan?
+- Are one to three ritual cues helpful, or do they become another routine to
+  maintain?
+- Can users replace the supplied language and cultural framing with wording and
+  rituals that feel natural to them?

docs/high-level-product-design.md

@@ -2,7 +2,7 @@
 
 Status: proposed product direction
 
-Updated: 2026-07-28
+Updated: 2026-08-31
 
 ## Implementation status
 
@@ -383,6 +383,12 @@ It asks:
 
 The close does not require journaling, complete time logs, or inbox zero.
 
+[Day-transition and achievement-closing inspiration](day-transition-and-closing-inspiration.md)
+records additional experiential input about balancing the visible work ahead
+with a brief acknowledgement of progress and effort, carrying one concrete next
+action forward, and using small user-chosen rituals to mark day boundaries. It
+is product-discovery input, not implemented or participant-validated behavior.
+
 ### 9. Learn: "Help plans become more realistic"
 
 A five-minute weekly review presents a small number of patterns: