docs(sdd): authorize frontend implementation

tasks/plan.md

@@ -1,9 +1,9 @@
 # Phase 2 Implementation Plan — Merchant Analytics Dashboard
 
-- Status: Approved
-- SDD phase: 2 — Plan approved; Phase 3 task list approved
+- Status: Approved — Phase 4 implementation authorized 2026-08-20
+- SDD phase: 4 — Plan and task list approved; implementation authorized
 - Capability: Merchant dashboard
-- Implementation authorization: Not granted
+- Implementation authorization: Granted by user on 2026-08-20
 - Approved task list: `tasks/todo.md`
 - Last updated: 2026-08-20
 
@@ -11,7 +11,7 @@
 
 Build the approved Persian RTL merchant analytics dashboard as a statically built SvelteKit application behind Nginx. The browser authenticates with the backend-owned server session, consumes the same-origin merchant API, renders the four analytics sections independently through snapshot/SSE delivery, provides safe merchant-owned detail views and CSV export, and meets the approved responsive, theme, privacy, and WCAG 2.2 AA contracts.
 
-This plan does not authorize scaffolding, dependency installation, Svelte components, API code, or deployment changes. After approval, SDD Phase 3 converts each work package into small tasks with explicit acceptance criteria, verification, dependencies, and no more than approximately five files per task.
+Implementation is authorized through the approved Phase 3 task list. Each work package remains constrained by its acceptance criteria, verification, dependencies, and approximately five-file limit.
 
 ## 2. Approved inputs
 
@@ -23,9 +23,9 @@ This plan does not authorize scaffolding, dependency installation, Svelte compon
 | Backend `IDENTITY-SPEC.md` | Approved | Session, login, logout, CSRF, throttle, and tenant boundary |
 | Backend `ANALYTICS-SPEC.md` | Approved | Metric lifecycle, partial delivery, retries, thresholds, and privacy |
 | Backend `METRIC-CATALOGUE.md` `0.4.0` | Approved definitions | Metric semantics and formatting evidence |
-| Backend `API-SPEC.md` | Draft | Proposed REST/SSE/CSV behavior; cannot yet authorize implementation |
-| Backend `docs/openapi.yaml` `0.1.0-draft` | Draft | Proposed generated types and operation contracts |
-| Nginx/static routing contract | Unresolved | Required before production/static-host verification |
+| Backend `API-SPEC.md` | Approved | REST/SSE/CSV behavior and provider boundary |
+| Backend `docs/openapi.yaml` `1.0.0` | Approved | Generated types and operation contracts |
+| Nginx/static routing contract | Approved | Production/static-host verification contract |
 
 ## 3. Planning assumptions
 
@@ -50,9 +50,9 @@ Implementation cannot start until all items in Gate A are approved. Foundation w
 - [x] CSV limits/encoding, audit retention, terminal-reference presentation, and the production Problem Details URI namespace are approved.
 - [x] UX export states are reconciled with synchronous CSV delivery and error handling.
 - [x] Nginx serves history fallback only for frontend routes; `/api/v1` and reserved operational paths never fall through to `index.html`.
-- [ ] Obtain a separate explicit instruction to begin implementation.
-- [ ] Confirm `merchant.displayName` from `AuthSession` is the shell/export display authority.
-- [ ] Confirm whether visible chart-data tables are sufficient or chart-data downloads are also required.
+- [x] Separate explicit instruction to begin implementation received on 2026-08-20.
+- [x] `merchant.displayName` from `AuthSession` is the shell/export display authority.
+- [x] Visible semantic chart-data tables are sufficient; chart-data download is not a separate MVP export.
 
 ### Gate B — scaffold verification
 
@@ -436,14 +436,14 @@ No Phase 3 task may say merely “build the dashboard” or combine a foundation
 
 Approved on 2026-08-20:
 
-1. Build order and the hard rule that implementation cannot consume `openapi.yaml` while it remains `0.1.0-draft`.
-2. Synchronous CSV defaults: 100,000 rows, 50 MiB, 60 seconds, 3 requests/10 minutes with burst 1, UTF-8 BOM, and ASCII `snake_case` headers.
-3. Thirty-day analytics/export audit retention for the hackathon.
+1. Build order and the hard rule that implementation consumes only the approved backend `openapi.yaml` version `1.0.0` from a recorded immutable source revision.
+2. Synchronous CSV defaults: 100,000 rows, 50 MiB, 60 seconds, 3 requests/10 minutes with burst 1, UTF-8 BOM, and the approved stable Persian headers.
+3. Ninety-day analytics/export audit retention for the hackathon; minimal demo-authentication audit retention remains 30 days.
 4. Display/export of the existing approved opaque terminal reference.
 5. `merchant.displayName` as the shell and CSV-preflight merchant name.
 6. Early SSE, CSV-delivery, and chart risk spikes before committing their implementation patterns or dependencies.
 
-Still external contract inputs: the production Problem Details base URI and the exact Nginx deep-link/static fallback plus `/api/v1` proxy behavior.
+Resolved external contracts: the production Problem Details base URI is owned by the backend contract, and the exact Nginx deep-link/static fallback plus `/api/v1` proxy behavior is owned by the deployment contract.
 
 ## 16. Official implementation references