diff --git a/README.md b/README.md
index 99f8227..e8753be 100644
--- a/README.md
+++ b/README.md
@@ -8,5 +8,5 @@ Current state: design/specification only. No frontend scaffold or runtime code h
 - [`docs/DASHBOARD-SPEC.md`](docs/DASHBOARD-SPEC.md): approved product requirements and acceptance criteria for implementation planning.
 - [`docs/DASHBOARD-UX-SPEC.md`](docs/DASHBOARD-UX-SPEC.md): detailed screen map, RTL layouts, async states, data presentation, accessibility, and authorized export workflows.
 - [`tasks/plan.md`](tasks/plan.md): approved SDD Phase 2 dependency order, risk spikes, vertical slices, and approval gates.
-- [`tasks/todo.md`](tasks/todo.md): draft SDD Phase 3 task list awaiting review before implementation.
+- [`tasks/todo.md`](tasks/todo.md): approved SDD Phase 3 task list; implementation remains explicitly paused and unauthorized.
 - [`AGENTS.md`](AGENTS.md): durable rules for future coding agents and contributors.
diff --git a/docs/DASHBOARD-SPEC.md b/docs/DASHBOARD-SPEC.md
index e59d649..d606570 100644
--- a/docs/DASHBOARD-SPEC.md
+++ b/docs/DASHBOARD-SPEC.md
@@ -4,7 +4,7 @@
 - Capability: Merchant dashboard
 - Last updated: 2026-08-20
 
-Detailed screen-level behavior, representative layouts, content, accessibility, partial-delivery states, and export workflows are specified in [`DASHBOARD-UX-SPEC.md`](DASHBOARD-UX-SPEC.md). Both specifications are approved for implementation planning; implementation still requires approval of the plan, task list, and applicable interface contracts.
+Detailed screen-level behavior, representative layouts, content, accessibility, partial-delivery states, and export workflows are specified in [`DASHBOARD-UX-SPEC.md`](DASHBOARD-UX-SPEC.md). Both specifications, the Phase 2 plan, and the Phase 3 task list are approved. Implementation remains paused pending a separate explicit authorization and approval of the applicable interface contracts.
 
 ## Objective
 
@@ -101,6 +101,6 @@ Resolved specification inputs:
 Still required before implementation:
 
 - Approved machine-readable analytics, identity, detail, SSE, error, and CSV export interface contracts.
-- Product/interface approval for the exact CSV schema, encoding, filename, row cap, delivery, retention, and audit behavior.
+- Provider contract incorporation of the approved CSV schema, UTF-8 BOM encoding, filename, 100,000-row and 50 MiB caps, synchronous 60-second delivery limit, rate limit, and 30-day audit retention behavior.
 - Static adapter fallback/routing behavior under the final Nginx configuration.
-- Approved Phase 2 implementation plan and Phase 3 task list.
+- Separate explicit authorization to begin Phase 4 implementation.
diff --git a/tasks/plan.md b/tasks/plan.md
index 06a1258..137b0bc 100644
--- a/tasks/plan.md
+++ b/tasks/plan.md
@@ -1,10 +1,10 @@
 # Phase 2 Implementation Plan — Merchant Analytics Dashboard
 
 - Status: Approved
-- SDD phase: 2 — Plan approved; Phase 3 task generation authorized
+- SDD phase: 2 — Plan approved; Phase 3 task list approved
 - Capability: Merchant dashboard
 - Implementation authorization: Not granted
-- Task-list target after approval: `tasks/todo.md`
+- Approved task list: `tasks/todo.md`
 - Last updated: 2026-08-20
 
 ## 1. Outcome
diff --git a/tasks/todo.md b/tasks/todo.md
index 9181f94..047fd7d 100644
--- a/tasks/todo.md
+++ b/tasks/todo.md
@@ -1,13 +1,16 @@
 # Phase 3 Task List — Merchant Analytics Dashboard
 
-- Status: Draft for human review
-- SDD phase: 3 — Tasks
+- Status: Approved task list — implementation explicitly paused
+- SDD phase: 3 — Tasks approved; Phase 4 not authorized
 - Source plan: [`plan.md`](plan.md)
 - Implementation authorization: Not granted
+- Approved by user: 2026-08-20
 - Last updated: 2026-08-20
 
 Tasks are ordered by dependency. Each implementation task must satisfy its acceptance criteria plus the Definition of Done in `tasks/plan.md`. Likely files are planning targets and may be adjusted before work begins, but a task must be split if it would exceed approximately five files or one focused session.
 
+Approval of this task list closes the SDD Phase 3 review gate only. It does not authorize starting any task, scaffolding the application, installing dependencies, editing application code, or otherwise entering Phase 4. Implementation begins only after a separate explicit user instruction.
+
 Commands named below are established by Task 4. Before then, verification uses the scaffold's generated commands and read-only contract checks.
 
 ## Phase A — Contract and executable foundation