diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md
index e4981cc..623335b 100644
--- a/.planning/ROADMAP.md
+++ b/.planning/ROADMAP.md
@@ -13,7 +13,7 @@ Ready2Blob is built inside-out: architectural foundation first, then pure genera
 Decimal phases appear between their surrounding integers in numeric order.
 
 - [x] **Phase 1: Foundation** - Project scaffold, TypeScript types, Backend Schema Registry, Zod schemas, and wizard state store (completed 2026-03-26)
-- [ ] **Phase 2: Generators** - Pure builder functions for rclone.conf and PowerShell deployment scripts, plus download manager
+- [x] **Phase 2: Generators** - Pure builder functions for rclone.conf and PowerShell deployment scripts, plus download manager (completed 2026-03-26)
 - [ ] **Phase 3: Wizard UI** - Multi-step wizard with backend selector, dynamic backend forms, and deployment options
 - [ ] **Phase 4: Review, Download & Security** - Live config preview, security warning gate, all download buttons, clipboard copy, and ZIP bundle
 
@@ -86,6 +86,6 @@ Phases execute in numeric order: 1 → 2 → 3 → 4
 | Phase | Plans Complete | Status | Completed |
 |-------|----------------|--------|-----------|
 | 1. Foundation | 4/4 | Complete   | 2026-03-26 |
-| 2. Generators | 1/4 | In Progress|  |
+| 2. Generators | 4/4 | Complete   | 2026-03-26 |
 | 3. Wizard UI | 0/? | Not started | - |
 | 4. Review, Download & Security | 0/? | Not started | - |
diff --git a/.planning/phases/02-generators/02-03-SUMMARY.md b/.planning/phases/02-generators/02-03-SUMMARY.md
new file mode 100644
index 0000000..ad17474
--- /dev/null
+++ b/.planning/phases/02-generators/02-03-SUMMARY.md
@@ -0,0 +1,111 @@
+---
+phase: 02-generators
+plan: 03
+subsystem: generators
+tags: [powershell, intune, rclone, deployment, script-generation]
+
+# Dependency graph
+requires:
+  - phase: 02-01
+    provides: Generator test stubs and barrel index.ts
+  - phase: 02-02
+    provides: buildRcloneConf (rclone INI config generator)
+provides:
+  - buildIntuneInstall — generates PS install script with UTF-8 no-BOM config write, conditional rclone download
+  - buildIntuneDetection — generates PS detection script with exit 0/1 and STDERR contamination guard
+  - CONFIG_DIR + buildRcloneInstallBlock — shared PS path constants and install snippet
+affects:
+  - 02-04 (RMM script generator — same pattern, uses $ErrorActionPreference)
+  - 03-ui (deploy step UI will call these generators with wizard state)
+
+# Tech tracking
+tech-stack:
+  added: []
+  patterns:
+    - Shared constants module (ps-helpers.ts) to guarantee path consistency across related scripts
+    - Here-string embedding for credential literals — prevents PS variable interpolation (security)
+    - Intune detection contract: no $ErrorActionPreference, Write-Output + exit 0/1 only
+
+key-files:
+  created:
+    - src/generators/ps-helpers.ts
+    - src/generators/intune-install.ts
+    - src/generators/intune-detection.ts
+  modified: []
+
+key-decisions:
+  - "PS here-string (@'...'@) embeds config content as literals — no PS variable interpolation, satisfies credential non-echo requirement"
+  - "buildIntuneDetection omits $ErrorActionPreference — Intune detection contract treats any STDERR as non-detection regardless of exit code"
+  - "CONFIG_DIR shared via ps-helpers.ts — single source of truth ensures install and detection scripts always reference the same Windows paths"
+  - "UTF-8 no-BOM write via [System.IO.File]::WriteAllText with UTF8Encoding($false) — Set-Content -Encoding UTF8 in PS 5.1 writes BOM"
+
+patterns-established:
+  - "Intune detection pattern: no $ErrorActionPreference, Write-Output signal, exit 0 / exit 1"
+  - "Shared helpers module for cross-generator constants to prevent path drift"
+
+requirements-completed: [DEPL-01, DEPL-02, DEPL-04, DEPL-05]
+
+# Metrics
+duration: resumed from partial
+completed: 2026-03-26
+---
+
+# Phase 2 Plan 3: Intune Generators Summary
+
+**Intune PowerShell install and detection generators with shared ps-helpers path map, UTF-8 no-BOM write idiom, and STDERR contamination guard**
+
+## Performance
+
+- **Duration:** Resumed from partial (previous run interrupted by rate limit)
+- **Completed:** 2026-03-26
+- **Tasks:** 2
+- **Files modified:** 3
+
+## Accomplishments
+
+- buildIntuneInstall generates a PS install script: creates directory idempotently, writes rclone.conf via [System.IO.File]::WriteAllText with UTF-8 no-BOM encoding, conditionally includes rclone download block
+- buildIntuneDetection generates a PS detection script: no $ErrorActionPreference, Write-Output signal, exit 0 when both rclone.exe and rclone.conf present, exit 1 otherwise
+- ps-helpers.ts provides CONFIG_DIR (machine-wide: C:\ProgramData\rclone, user-profile: %APPDATA%\rclone) and buildRcloneInstallBlock — shared across both generators to guarantee path consistency
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: Create ps-helpers.ts shared module** - `6a7912d` (feat)
+2. **Task 2: Implement buildIntuneInstall and buildIntuneDetection** - `495be0c` (feat)
+
+## Files Created/Modified
+
+- `src/generators/ps-helpers.ts` - CONFIG_DIR record and buildRcloneInstallBlock snippet builder
+- `src/generators/intune-install.ts` - buildIntuneInstall pure function
+- `src/generators/intune-detection.ts` - buildIntuneDetection pure function
+
+## Decisions Made
+
+- PS here-string (@'...'@) embeds config content as literals — no PS variable interpolation, satisfies credential non-echo requirement
+- buildIntuneDetection omits $ErrorActionPreference — Intune detection contract treats any STDERR as non-detection regardless of exit code
+- CONFIG_DIR shared via ps-helpers.ts — single source of truth ensures install and detection scripts always reference the same Windows paths
+- UTF-8 no-BOM write via [System.IO.File]::WriteAllText with UTF8Encoding($false) — Set-Content -Encoding UTF8 in PS 5.1 writes BOM (a known incompatibility)
+
+## Deviations from Plan
+
+None - plan executed exactly as written. Previous run interrupted by rate limit but files were already correct when resumed; only required committing and SUMMARY creation.
+
+## Issues Encountered
+
+Previous run was interrupted by API rate limit before committing intune-install.ts and intune-detection.ts. Files were found complete and correct on resumption. Tests confirmed 15/15 passing before committing.
+
+## User Setup Required
+
+None - no external service configuration required.
+
+## Next Phase Readiness
+
+- All Intune generator tests (15 assertions) pass GREEN
+- Full test suite (61 assertions) passes
+- buildIntuneInstall and buildIntuneDetection ready for Phase 3 UI integration (deploy step)
+- CONFIG_DIR from ps-helpers.ts guarantees install and detection scripts always match paths — no path drift risk
+
+---
+*Phase: 02-generators*
+*Completed: 2026-03-26*