diff --git a/tests/Feature/HostStepTest.php b/tests/Feature/HostStepTest.php
index 5e165c8..ed7019d 100644
--- a/tests/Feature/HostStepTest.php
+++ b/tests/Feature/HostStepTest.php
@@ -130,9 +130,31 @@ it('reports the contract version the updater compares against', function () {
     // failure mode this number exists for; if update.sh asked for a version the
     // current installer never writes, every up-to-date server would be told to
     // run the installer again forever.
-    $needs = Str::between(file_get_contents(base_path('deploy/update.sh')), 'HOST_STEP_NEEDS=', "\n");
+    //
+    // Compared at RUNTIME against deploy/lib/release.sh's
+    // release_host_step_needs(), not by pulling the literal `HOST_STEP_NEEDS=`
+    // line out of update.sh: since Task 2 update.sh no longer carries the bare
+    // number itself, it asks that shell function for it —
+    // `HOST_STEP_NEEDS="$(release_host_step_needs)"`. Extracting the text
+    // between `HOST_STEP_NEEDS=` and the newline would hand back the command
+    // substitution string, not a number, and this test would silently compare
+    // "3" against "0" forever without ever catching the two halves drifting
+    // apart. The left side (CONTRACT) and the right side (release_host_step_needs)
+    // come from two different files — install-agent.sh and deploy/lib/release.sh
+    // — so raising one without the other still turns this test red.
+    $needsProcess = Process::fromShellCommandline(
+        'bash -c '.escapeshellarg(
+            'set -Eeuo pipefail; . '.escapeshellarg(base_path('deploy/lib/release.sh')).'; release_host_step_needs'
+        )
+    );
+    $needsProcess->run();
 
-    expect((int) trim($process->getOutput()))->toBe((int) trim($needs));
+    expect($needsProcess->getExitCode())->toBe(0);
+
+    $needs = trim($needsProcess->getOutput());
+
+    expect($needs)->toMatch('/^\d+$/')
+        ->and((int) trim($process->getOutput()))->toBe((int) $needs);
 });
 
 it('grants one command line, not a script the service account can rewrite', function () {