diff --git a/.planning/phases/04-review-download-security/04-VALIDATION.md b/.planning/phases/04-review-download-security/04-VALIDATION.md
new file mode 100644
index 0000000..40a8904
--- /dev/null
+++ b/.planning/phases/04-review-download-security/04-VALIDATION.md
@@ -0,0 +1,83 @@
+---
+phase: 4
+slug: review-download-security
+status: draft
+nyquist_compliant: false
+wave_0_complete: false
+created: 2026-03-27
+---
+
+# Phase 4 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | Vitest ^4.1.1 |
+| **Config file** | `vite.config.ts` (test block, environment: jsdom) |
+| **Quick run command** | `npm test` |
+| **Full suite command** | `npm test` |
+| **Estimated runtime** | ~10 seconds |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** Run `npm test`
+- **After every plan wave:** Run `npm test`
+- **Before `/gsd:verify-work`:** Full suite must be green
+- **Max feedback latency:** ~10 seconds
+
+---
+
+## Per-Task Verification Map
+
+| Task ID | Plan | Wave | Requirement | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|-----------|-------------------|-------------|--------|
+| 4-01-01 | 01 | 0 | CONF-02, CONF-03, DOWN-01–DOWN-06, SECU-01, SECU-02 | unit | `npm test -- src/components/wizard/ReviewStep.test.tsx` | ❌ W0 | ⬜ pending |
+| 4-01-02 | 01 | 0 | SECU-03 | unit | `npm test -- src/store/reducer.test.ts` | ✅ | ⬜ pending |
+| 4-02-01 | 02 | 1 | CONF-02 | unit | `npm test -- src/components/wizard/ReviewStep.test.tsx` | ❌ W0 | ⬜ pending |
+| 4-02-02 | 02 | 1 | SECU-01, SECU-02 | unit | `npm test -- src/components/wizard/ReviewStep.test.tsx` | ❌ W0 | ⬜ pending |
+| 4-03-01 | 03 | 2 | DOWN-01, DOWN-02, DOWN-03, DOWN-04 | unit | `npm test -- src/components/wizard/ReviewStep.test.tsx` | ❌ W0 | ⬜ pending |
+| 4-03-02 | 03 | 2 | CONF-03, DOWN-06 | unit | `npm test -- src/components/wizard/ReviewStep.test.tsx` | ❌ W0 | ⬜ pending |
+| 4-04-01 | 04 | 3 | DOWN-05 | unit | `npm test -- src/components/wizard/ReviewStep.test.tsx` | ❌ W0 | ⬜ pending |
+| 4-05-01 | 05 | 4 | CONF-02, CONF-03, DOWN-01–DOWN-06, SECU-01, SECU-02, SECU-03 | unit | `npm test` | ❌ W0 | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [ ] `src/components/wizard/ReviewStep.test.tsx` — stubs for CONF-02, CONF-03, DOWN-01–DOWN-06, SECU-01, SECU-02
+- [ ] Mock setup for `URL.createObjectURL`, `URL.revokeObjectURL`, `navigator.clipboard.writeText` in test file setup
+- [ ] SECU-03 assertion added to existing `src/store/reducer.test.ts`
+
+*Note: `src/utils/downloadFile.ts` (referenced by tests) is created in the implementation wave, not Wave 0. Wave 0 stubs the test file with correct import paths.*
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| ZIP file opens correctly with all 4 files inside | DOWN-05 | jsdom cannot verify actual ZIP binary content | Download ZIP in browser, open with OS ZIP tool, verify 4 files present |
+| File actually downloads in browser | DOWN-01–DOWN-04 | jsdom lacks real download behavior | Click each download button in Chromium/Firefox dev build, verify file saved |
+| Clipboard paste works end-to-end | CONF-03, DOWN-06 | jsdom clipboard mock doesn't paste | Click copy, paste into text editor, verify content matches displayed preview |
+
+---
+
+## Validation Sign-Off
+
+- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
+- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
+- [ ] Wave 0 covers all MISSING references
+- [ ] No watch-mode flags
+- [ ] Feedback latency < 15s
+- [ ] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** pending