docs(tasks): record implementation task approval

README.md

@@ -8,5 +8,5 @@ Current state: design/specification only. No frontend scaffold or runtime code h
 - [`docs/DASHBOARD-SPEC.md`](docs/DASHBOARD-SPEC.md): approved product requirements and acceptance criteria for implementation planning.
 - [`docs/DASHBOARD-UX-SPEC.md`](docs/DASHBOARD-UX-SPEC.md): detailed screen map, RTL layouts, async states, data presentation, accessibility, and authorized export workflows.
 - [`tasks/plan.md`](tasks/plan.md): approved SDD Phase 2 dependency order, risk spikes, vertical slices, and approval gates.
-- [`tasks/todo.md`](tasks/todo.md): draft SDD Phase 3 task list awaiting review before implementation.
+- [`tasks/todo.md`](tasks/todo.md): approved SDD Phase 3 task list; implementation remains explicitly paused and unauthorized.
 - [`AGENTS.md`](AGENTS.md): durable rules for future coding agents and contributors.

docs/DASHBOARD-SPEC.md

@@ -4,7 +4,7 @@
 - Capability: Merchant dashboard
 - Last updated: 2026-08-20
 
-Detailed screen-level behavior, representative layouts, content, accessibility, partial-delivery states, and export workflows are specified in [`DASHBOARD-UX-SPEC.md`](DASHBOARD-UX-SPEC.md). Both specifications are approved for implementation planning; implementation still requires approval of the plan, task list, and applicable interface contracts.
+Detailed screen-level behavior, representative layouts, content, accessibility, partial-delivery states, and export workflows are specified in [`DASHBOARD-UX-SPEC.md`](DASHBOARD-UX-SPEC.md). Both specifications, the Phase 2 plan, and the Phase 3 task list are approved. Implementation remains paused pending a separate explicit authorization and approval of the applicable interface contracts.
 
 ## Objective
 
@@ -101,6 +101,6 @@ Resolved specification inputs:
 Still required before implementation:
 
 - Approved machine-readable analytics, identity, detail, SSE, error, and CSV export interface contracts.
-- Product/interface approval for the exact CSV schema, encoding, filename, row cap, delivery, retention, and audit behavior.
+- Provider contract incorporation of the approved CSV schema, UTF-8 BOM encoding, filename, 100,000-row and 50 MiB caps, synchronous 60-second delivery limit, rate limit, and 30-day audit retention behavior.
 - Static adapter fallback/routing behavior under the final Nginx configuration.
-- Approved Phase 2 implementation plan and Phase 3 task list.
+- Separate explicit authorization to begin Phase 4 implementation.

tasks/plan.md

@@ -1,10 +1,10 @@
 # Phase 2 Implementation Plan — Merchant Analytics Dashboard
 
 - Status: Approved
-- SDD phase: 2 — Plan approved; Phase 3 task generation authorized
+- SDD phase: 2 — Plan approved; Phase 3 task list approved
 - Capability: Merchant dashboard
 - Implementation authorization: Not granted
-- Task-list target after approval: `tasks/todo.md`
+- Approved task list: `tasks/todo.md`
 - Last updated: 2026-08-20
 
 ## 1. Outcome

tasks/todo.md

@@ -1,13 +1,16 @@
 # Phase 3 Task List — Merchant Analytics Dashboard
 
-- Status: Draft for human review
+- Status: Approved task list — implementation explicitly paused
-- SDD phase: 3 — Tasks
+- SDD phase: 3 — Tasks approved; Phase 4 not authorized
 - Source plan: [`plan.md`](plan.md)
 - Implementation authorization: Not granted
+- Approved by user: 2026-08-20
 - Last updated: 2026-08-20
 
 Tasks are ordered by dependency. Each implementation task must satisfy its acceptance criteria plus the Definition of Done in `tasks/plan.md`. Likely files are planning targets and may be adjusted before work begins, but a task must be split if it would exceed approximately five files or one focused session.
 
+Approval of this task list closes the SDD Phase 3 review gate only. It does not authorize starting any task, scaffolding the application, installing dependencies, editing application code, or otherwise entering Phase 4. Implementation begins only after a separate explicit user instruction.
+
 Commands named below are established by Task 4. Before then, verification uses the scaffold's generated commands and read-only contract checks.
 
 ## Phase A — Contract and executable foundation