diff --git a/server/scripts/reporting-lock-policy.test.mjs b/server/scripts/reporting-lock-policy.test.mjs
new file mode 100644
index 00000000000..144db19dcf4
--- /dev/null
+++ b/server/scripts/reporting-lock-policy.test.mjs
@@ -0,0 +1,26 @@
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { copyFile, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { expect, it } from 'vitest';
+import { prepareReportLock } from '../../tests/runner-e2e/prepare-report-lock.mjs';
+
+it('admits the committed controller lock through the reviewed reporting policy before paid execution', async () => {
+  const repository = fileURLToPath(new URL('../../', import.meta.url));
+  const root = await mkdtemp(path.join(tmpdir(), 'controller-report-policy-'));
+  const relative = 'tests/runner-e2e';
+  try {
+    await mkdir(path.join(root, relative), { recursive: true });
+    for (const file of ['report-lock.json', 'report-lock.patch']) {
+      await copyFile(path.join(repository, relative, file), path.join(root, relative, file));
+    }
+    await writeFile(path.join(root, 'pnpm-lock.yaml'), execFileSync('git', ['show', 'HEAD:pnpm-lock.yaml'], { cwd: repository }));
+    await prepareReportLock(root);
+    const policy = JSON.parse(await readFile(path.join(root, relative, 'report-lock.json'), 'utf8'));
+    expect(createHash('sha256').update(await readFile(path.join(root, 'pnpm-lock.yaml'))).digest('hex')).toBe(policy.outputSha256);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
diff --git a/tests/runner-e2e/report-lock.json b/tests/runner-e2e/report-lock.json
index e3d105e4c77..4af35109e6a 100644
--- a/tests/runner-e2e/report-lock.json
+++ b/tests/runner-e2e/report-lock.json
@@ -1,6 +1,6 @@
 {
-  "inputSha256": "7540075e96f9a93924a1e54775c17346c5760dd5d02902d83fb5228f918996ba",
-  "outputSha256": "60f4c06bca47af3ab9d74281f2ef2e1ff559d566b862ba51c2fbe6c8e5bac35b",
+  "inputSha256": "ea91060774e3289d5d07bc58f72d8953f5a6dcb9db98aa9a1adf202476bf89ac",
+  "outputSha256": "6f252b0c8099ed837a297f97f1fc5e14e96bc7530b0239065d0789b33b2ee477",
   "patchSha256": "2adced9a66052ba5752140ec6cc6670f679552a9a8559bd1faea10036afeeb97",
-  "basis": "Generated with the trusted master lockfile refresh. Review this offline correction and its hashes with the dependency changes."
+  "basis": "Reviewed current master after the advanced-imessage 2.2.0 and protobuf 2.16.0 lock update. The existing correction patch is unchanged; its reverse/forward roundtrip reproduces this exact output. Unknown locks, changed patches and wrong outputs still reject."
 }