diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md
index a59e5cc..87a5722 100644
--- a/PUBLIC_SOURCE_EXPORT.md
+++ b/PUBLIC_SOURCE_EXPORT.md
@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `ad0a390e431166c3198a2ac3bec010c2b44f2dea`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `a898651d5411fca177825aa908a157a34f4ce4a8`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json
index 1932ae6..c34aa58 100644
--- a/PUBLIC_SOURCE_MANIFEST.json
+++ b/PUBLIC_SOURCE_MANIFEST.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "ad0a390e431166c3198a2ac3bec010c2b44f2dea",
+  "sourceRevision": "a898651d5411fca177825aa908a157a34f4ce4a8",
   "files": [
     {
       "path": ".dockerignore",
@@ -832,6 +832,11 @@
       "sha256": "2bc2345aa0ea65aa78471aac85909c671040041c44cdb67d01c127c1be17eb70",
       "bytes": 18590
     },
+    {
+      "path": "backend/tests/test_controller_root_procedure_contract.py",
+      "sha256": "618a3c641191d5b9ebd904856b56d71ad1661e251c29c86f9b635ad856557ee7",
+      "bytes": 1866
+    },
     {
       "path": "backend/tests/test_controller_state_reconciliation.py",
       "sha256": "d00b8bcf388e17f0c1b8999d4b511fede7212b8ef83282905328d1b0b4b70f76",
diff --git a/backend/tests/test_controller_root_procedure_contract.py b/backend/tests/test_controller_root_procedure_contract.py
new file mode 100644
index 0000000..2116737
--- /dev/null
+++ b/backend/tests/test_controller_root_procedure_contract.py
@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+import re
+import shlex
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def test_windows_wrapper_archives_every_file_required_by_root_installer():
+    installer = (ROOT / "scripts/upgrade_deployment_controller.sh").read_text(encoding="utf-8")
+    wrapper = (ROOT / "scripts/upgrade_deployment_controller.ps1").read_text(encoding="utf-8")
+
+    required = re.search(r"source_paths=\(\s*(.*?)\n\)", installer, re.DOTALL)
+    archived = re.search(r"& git archive --format=tar .*? \$SourceRevision (.*?)\r?\n", wrapper)
+    assert required is not None and archived is not None
+    archive_paths = set(shlex.split(archived.group(1)))
+    assert all(
+        path in archive_paths
+        or any(path.startswith(f"{directory}/") for directory in archive_paths)
+        for path in shlex.split(required.group(1))
+    )
+    assert "scripts/prepare_controller_hub_release_volume.py" in archived.group(1)
+    assert "scripts/upgrade_deployment_controller.sh" in archived.group(1)
+
+
+def test_windows_wrapper_supplies_private_archive_and_exact_image_identity():
+    wrapper = (ROOT / "scripts/upgrade_deployment_controller.ps1").read_text(encoding="utf-8")
+    installer = (ROOT / "scripts/upgrade_deployment_controller.sh").read_text(encoding="utf-8")
+
+    assert "mktemp -d -p /tmp 'itworx-controller-artifact-promoter-" in wrapper
+    assert "^/tmp/itworx-controller-artifact-promoter-" in wrapper
+    assert '"chmod 600 \'$remoteArchive\' && chmod 700 \'$remoteScript\'' in wrapper
+    assert "docker inspect --format '{{.Image}}' gitea-deploy-control" in wrapper
+    assert "-cnotmatch '^sha256:[0-9a-f]{64}$'" in wrapper
+    assert "--image-id '$imageId'" in wrapper
+    assert "--image-id) image_id=\"$2\"" in installer
+    assert '[[ "$archive_parent" =~ ^/tmp/itworx-controller-artifact-promoter-' in installer