docs(tasks): record implementation task approval

tasks/plan.md

@@ -1,10 +1,10 @@
 # Phase 2 Implementation Plan — Merchant Analytics Dashboard
 
 - Status: Approved
-- SDD phase: 2 — Plan approved; Phase 3 task generation authorized
+- SDD phase: 2 — Plan approved; Phase 3 task list approved
 - Capability: Merchant dashboard
 - Implementation authorization: Not granted
-- Task-list target after approval: `tasks/todo.md`
+- Approved task list: `tasks/todo.md`
 - Last updated: 2026-08-20
 
 ## 1. Outcome

tasks/todo.md

@@ -1,13 +1,16 @@
 # Phase 3 Task List — Merchant Analytics Dashboard
 
-- Status: Draft for human review
-- SDD phase: 3 — Tasks
+- Status: Approved task list — implementation explicitly paused
+- SDD phase: 3 — Tasks approved; Phase 4 not authorized
 - Source plan: [`plan.md`](plan.md)
 - Implementation authorization: Not granted
+- Approved by user: 2026-08-20
 - Last updated: 2026-08-20
 
 Tasks are ordered by dependency. Each implementation task must satisfy its acceptance criteria plus the Definition of Done in `tasks/plan.md`. Likely files are planning targets and may be adjusted before work begins, but a task must be split if it would exceed approximately five files or one focused session.
 
+Approval of this task list closes the SDD Phase 3 review gate only. It does not authorize starting any task, scaffolding the application, installing dependencies, editing application code, or otherwise entering Phase 4. Implementation begins only after a separate explicit user instruction.
+
 Commands named below are established by Task 4. Before then, verification uses the scaffold's generated commands and read-only contract checks.
 
 ## Phase A — Contract and executable foundation