docs(04-03): complete ReviewStep plan — 10 req behaviors GREEN, 98/98 tests pass

- 04-03-SUMMARY.md: documents implementation, deviations, and test fixes
- STATE.md: advanced to plan 04, recorded metrics and decisions
- ROADMAP.md: updated phase 4 progress (3/5 summaries)

.planning/ROADMAP.md

@@ -95,4 +95,4 @@ Phases execute in numeric order: 1 → 2 → 3 → 4
 | 1. Foundation | 4/4 | Complete   | 2026-03-26 |
 | 2. Generators | 4/4 | Complete   | 2026-03-26 |
 | 3. Wizard UI | 5/5 | Complete   | 2026-03-27 |
-| 4. Review, Download & Security | 2/5 | In Progress|  |
+| 4. Review, Download & Security | 3/5 | In Progress|  |

.planning/STATE.md

@@ -3,14 +3,14 @@ gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
 status: executing
-stopped_at: Completed 04-review-download-security-04-02-PLAN.md
+stopped_at: Completed 04-review-download-security-04-03-PLAN.md
-last_updated: "2026-03-27T10:46:35.092Z"
+last_updated: "2026-03-27T10:53:40.224Z"
 last_activity: 2026-03-26 — Completed plan 01-02 (Backend Schema Registry)
 progress:
   total_phases: 4
   completed_phases: 3
   total_plans: 18
-  completed_plans: 15
+  completed_plans: 16
   percent: 50
 ---
 
@@ -63,6 +63,7 @@ Progress: [█████░░░░░] 50%
 | Phase 03-wizard-ui P05 | 5min | 3 tasks | 5 files |
 | Phase 04-review-download-security P01 | 2min | 2 tasks | 2 files |
 | Phase 04-review-download-security P02 | 2min | 2 tasks | 5 files |
+| Phase 04-review-download-security P03 | 4min | 1 tasks | 2 files |
 
 ## Accumulated Context
 
@@ -111,6 +112,9 @@ Recent decisions affecting current work:
 - [Phase 04-review-download-security]: No src/utils/index.ts barrel — direct imports keep test mock paths predictable
 - [Phase 04-review-download-security]: Do NOT install @types/jszip — JSZip 3.x ships own TypeScript declarations
 - [Phase 04-review-download-security]: OutputBlock disabled prop gates both Copy and Download buttons — visual opacity-40 without hiding (SECU-01 gate)
+- [Phase 04-review-download-security]: [04-03] Security checkbox must be clicked before testing action buttons — disabled buttons don't fire onClick in jsdom
+- [Phase 04-review-download-security]: [04-03] vi.stubGlobal must come after vi.clearAllMocks in beforeEach — clear order matters for mock reliability
+- [Phase 04-review-download-security]: [04-03] Native DOM .disabled/.checked properties used instead of jest-dom matchers — jest-dom not installed in this project
 
 ### Pending Todos
 
@@ -124,6 +128,6 @@ None yet.
 
 ## Session Continuity
 
-Last session: 2026-03-27T10:46:29.087Z
+Last session: 2026-03-27T10:53:40.221Z
-Stopped at: Completed 04-review-download-security-04-02-PLAN.md
+Stopped at: Completed 04-review-download-security-04-03-PLAN.md
 Resume file: None

.planning/phases/04-review-download-security/04-03-SUMMARY.md

@@ -0,0 +1,137 @@
+---
+phase: 04-review-download-security
+plan: 03
+subsystem: ui
+tags: [react, vitest, testing-library, rclone, download, zip, clipboard]
+
+# Dependency graph
+requires:
+  - phase: 04-review-download-security-02
+    provides: OutputBlock component, downloadFile and downloadZip utilities
+  - phase: 04-review-download-security-01
+    provides: Wave 0 TDD stubs for ReviewStep, SECU-03 reducer test
+  - phase: 02-generators
+    provides: buildRcloneConf, buildIntuneInstall, buildIntuneDetection, buildRmmScript
+  - phase: 01-foundation
+    provides: WizardState, useWizard hook, WizardProvider context
+provides:
+  - ReviewStep component — composites all download, copy, preview, and security gate behaviors
+  - All 10 requirement behaviors (CONF-02, CONF-03, DOWN-01–DOWN-06, SECU-01, SECU-02) tested GREEN
+affects: [03-wizard-ui, App.tsx integration]
+
+# Tech tracking
+tech-stack:
+  added: []
+  patterns:
+    - "useMemo with try/catch for generator calls — prevents crash on incomplete wizard state"
+    - "Security acknowledgement checkbox as gate for all destructive/export actions"
+    - "vi.stubGlobal after vi.clearAllMocks in beforeEach — ensures fresh clipboard mock per test"
+    - "Native DOM .disabled/.checked instead of jest-dom matchers when jest-dom not installed"
+
+key-files:
+  created:
+    - src/components/wizard/ReviewStep.tsx
+  modified:
+    - src/components/wizard/ReviewStep.test.tsx
+
+key-decisions:
+  - "Checkbox must be checked before testing clipboard/download clicks — disabled buttons don't fire onClick"
+  - "vi.stubGlobal order matters: must come AFTER vi.clearAllMocks or cleared mocks break clipboard assertions"
+  - "Use HTMLInputElement/HTMLButtonElement cast + .checked/.disabled properties — no jest-dom installed"
+  - "Default export alongside named export for ReviewStep — test file uses default import"
+
+patterns-established:
+  - "Security gate pattern: useState(false) acknowledged + disabled={!acknowledged} on all action buttons"
+  - "useMemo generator pattern: try { return generator(state) } catch { return placeholder } for resilient preview"
+
+requirements-completed: [CONF-02, CONF-03, DOWN-01, DOWN-02, DOWN-03, DOWN-04, DOWN-05, DOWN-06, SECU-01, SECU-02]
+
+# Metrics
+duration: 4min
+completed: 2026-03-27
+---
+
+# Phase 4 Plan 03: ReviewStep Implementation Summary
+
+**ReviewStep composing live rclone.conf preview, security acknowledgement gate, 4 file download/copy blocks, and ZIP bundle — all 10 requirement behaviors tested GREEN**
+
+## Performance
+
+- **Duration:** 4 min
+- **Started:** 2026-03-27T10:48:03Z
+- **Completed:** 2026-03-27T10:52:00Z
+- **Tasks:** 1
+- **Files modified:** 2
+
+## Accomplishments
+
+- ReviewStep.tsx implemented with all 10 requirement behaviors (CONF-02, CONF-03, DOWN-01 through DOWN-06, SECU-01, SECU-02)
+- All 10 Wave 0 `expect.fail` stubs replaced with real assertions, 10/10 tests GREEN
+- Full test suite (98 tests, 12 files) passes with no regressions
+- Security gate pattern: checkbox gates all download and copy actions via disabled prop
+- useMemo try/catch pattern prevents crash when wizard state is incomplete (PLACEHOLDER shown)
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: Implement ReviewStep.tsx — full component turning all stubs GREEN** - `259fff6` (feat)
+
+## Files Created/Modified
+
+- `src/components/wizard/ReviewStep.tsx` — Step 3 component: live preview, security gate, 4 OutputBlocks, Download All ZIP button
+- `src/components/wizard/ReviewStep.test.tsx` — Replaced all 10 `expect.fail` stubs with real assertions
+
+## Decisions Made
+
+- **Checkbox required before testing clipboard/download**: Disabled buttons don't fire onClick in jsdom — tests must click the security checkbox first before testing download/copy actions.
+- **vi.stubGlobal after vi.clearAllMocks**: clearAllMocks would reset the clipboard mock if called after stubGlobal; order matters in beforeEach.
+- **Native DOM properties instead of jest-dom**: Since `@testing-library/jest-dom` is not installed, used `(el as HTMLButtonElement).disabled` and `(el as HTMLInputElement).checked` for assertions.
+- **Default export added**: Test file uses `import ReviewStep from './ReviewStep'` (default import) — added `export default ReviewStep` alongside the named export.
+
+## Deviations from Plan
+
+### Auto-fixed Issues
+
+**1. [Rule 1 - Bug] vi.stubGlobal ordering fixed for clipboard mock reliability**
+- **Found during:** Task 1 (TDD GREEN phase — first test run)
+- **Issue:** `vi.clearAllMocks()` called AFTER `vi.stubGlobal` reset the clipboard mock, causing clipboard assertions to fail with "called 0 times"
+- **Fix:** Reordered beforeEach to call `vi.clearAllMocks()` first, then `vi.stubGlobal` after
+- **Files modified:** src/components/wizard/ReviewStep.test.tsx
+- **Verification:** CONF-03 and DOWN-06 clipboard tests pass
+- **Committed in:** 259fff6 (Task 1 commit)
+
+**2. [Rule 1 - Bug] jest-dom matchers unavailable — switched to native DOM assertions**
+- **Found during:** Task 1 (SECU-01 test)
+- **Issue:** `toBeChecked()` and `toBeDisabled()` require `@testing-library/jest-dom` which is not installed
+- **Fix:** Used native HTML element property checks: `.checked`, `.disabled` with TypeScript casts
+- **Files modified:** src/components/wizard/ReviewStep.test.tsx
+- **Verification:** SECU-01 test passes GREEN
+- **Committed in:** 259fff6 (Task 1 commit)
+
+**3. [Rule 1 - Bug] Security checkbox must be clicked before testing action buttons**
+- **Found during:** Task 1 (CONF-03, DOWN-06 tests)
+- **Issue:** Plan stubs didn't show that Copy buttons are disabled by default; fireEvent.click on a disabled button doesn't fire onClick in jsdom
+- **Fix:** Added `fireEvent.click(checkbox)` at the start of CONF-03 and DOWN-06 tests to enable buttons before testing
+- **Files modified:** src/components/wizard/ReviewStep.test.tsx
+- **Verification:** All clipboard-related tests pass GREEN
+- **Committed in:** 259fff6 (Task 1 commit)
+
+---
+
+**Total deviations:** 3 auto-fixed (3 bugs in test implementation)
+**Impact on plan:** All fixes were corrections to test code to align with the component's actual behavior. No scope creep.
+
+## Issues Encountered
+
+None beyond the three auto-fixed test assertion issues above.
+
+## Next Phase Readiness
+
+- ReviewStep is complete and fully tested — ready for Phase 4 Plan 04 (wire ReviewStep into App.tsx as Step 3)
+- All 10 requirement behaviors verified GREEN
+- Full suite 98/98 tests passing
+
+---
+*Phase: 04-review-download-security*
+*Completed: 2026-03-27*