diff --git a/.planning/phases/02-generators/02-VALIDATION.md b/.planning/phases/02-generators/02-VALIDATION.md
new file mode 100644
index 0000000..03e1709
--- /dev/null
+++ b/.planning/phases/02-generators/02-VALIDATION.md
@@ -0,0 +1,82 @@
+---
+phase: 2
+slug: generators
+status: draft
+nyquist_compliant: false
+wave_0_complete: false
+created: 2026-03-26
+---
+
+# Phase 2 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | Vitest 4.1.1 (already installed) |
+| **Config file** | `vitest.config.ts` — exists, `environment: 'node'`, `globals: true` |
+| **Quick run command** | `npm test` |
+| **Full suite command** | `npm test` |
+| **Estimated runtime** | ~5 seconds |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** Run `npm test`
+- **After every plan wave:** Run `npm test`
+- **Before `/gsd:verify-work`:** Full suite must be green
+- **Max feedback latency:** 10 seconds
+
+---
+
+## Per-Task Verification Map
+
+| Task ID | Plan | Wave | Requirement | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|-----------|-------------------|-------------|--------|
+| 2-01-01 | 01 | 0 | CONF-01 | unit | `npm test -- src/generators/rclone-conf.test.ts` | ❌ W0 | ⬜ pending |
+| 2-01-02 | 01 | 0 | DEPL-01 | unit | `npm test -- src/generators/intune-install.test.ts` | ❌ W0 | ⬜ pending |
+| 2-01-03 | 01 | 0 | DEPL-02 | unit | `npm test -- src/generators/intune-detection.test.ts` | ❌ W0 | ⬜ pending |
+| 2-01-04 | 01 | 0 | DEPL-03 | unit | `npm test -- src/generators/rmm-script.test.ts` | ❌ W0 | ⬜ pending |
+| 2-02-01 | 02 | 1 | CONF-01 | unit | `npm test -- src/generators/rclone-conf.test.ts` | ❌ W0 | ⬜ pending |
+| 2-02-02 | 02 | 1 | DEPL-01, DEPL-04, DEPL-05 | unit | `npm test -- src/generators/intune-install.test.ts` | ❌ W0 | ⬜ pending |
+| 2-02-03 | 02 | 1 | DEPL-02, DEPL-05 | unit | `npm test -- src/generators/intune-detection.test.ts` | ❌ W0 | ⬜ pending |
+| 2-02-04 | 02 | 1 | DEPL-03, DEPL-04, DEPL-05 | unit | `npm test -- src/generators/rmm-script.test.ts` | ❌ W0 | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+- [ ] `src/generators/rclone-conf.test.ts` — stubs for CONF-01 (all three backends, type mapping, empty field omission)
+- [ ] `src/generators/intune-install.test.ts` — stubs for DEPL-01, DEPL-04, DEPL-05
+- [ ] `src/generators/intune-detection.test.ts` — stubs for DEPL-02, DEPL-05
+- [ ] `src/generators/rmm-script.test.ts` — stubs for DEPL-03, DEPL-04, DEPL-05
+- [ ] `src/generators/index.ts` — re-export barrel (no tests needed; required for Phase 4 imports)
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| Generated PowerShell actually runs without BOM in SYSTEM context | DEPL-01, DEPL-03 | Requires real PS 5.1 SYSTEM session | Copy generated script to a test VM, run as SYSTEM via PsExec, verify rclone.conf is written without BOM |
+| Intune detection exits 0 with only STDOUT (no STDERR) | DEPL-02 | Cannot simulate Intune detection contract in unit test | Run detection script in Intune sandbox or via test Win32 app deployment |
+
+---
+
+## Validation Sign-Off
+
+- [ ] All tasks have `<automated>` verify or Wave 0 dependencies
+- [ ] Sampling continuity: no 3 consecutive tasks without automated verify
+- [ ] Wave 0 covers all MISSING references
+- [ ] No watch-mode flags
+- [ ] Feedback latency < 10s
+- [ ] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** pending