diff --git a/docs/testing/ecc-2.2-release-readiness.tdd.md b/docs/testing/ecc-2.2-release-readiness.tdd.md
index 45f1730bf..e7bb60244 100644
--- a/docs/testing/ecc-2.2-release-readiness.tdd.md
+++ b/docs/testing/ecc-2.2-release-readiness.tdd.md
@@ -40,7 +40,7 @@ Commit `5aa66021` moved ambient-override checks into isolated child processes an
 ## GREEN
 
 - Focused installer, lifecycle, packaging, release-workflow, manifest, OpenCode, Antigravity, and uninstall tests passed.
-- Full repository suite: 3,986 passed, 0 failed.
+- Full repository suite: 3,987 passed, 0 failed.
 - `npm audit --audit-level=low`: 0 vulnerabilities.
 - Supply-chain IOC scan: 207 files inspected, no findings.
 - Both release workflow YAML files parsed successfully.
diff --git a/tests/ci/nasiko-control-plane.test.js b/tests/ci/nasiko-control-plane.test.js
index 8b7cbdc49..53b67b990 100644
--- a/tests/ci/nasiko-control-plane.test.js
+++ b/tests/ci/nasiko-control-plane.test.js
@@ -143,7 +143,13 @@ async function main() {
         assert.strictEqual(fs.existsSync(lockPath), true);
         releaseLock();
         assert.strictEqual(fs.existsSync(lockPath), false);
-
+      } finally { fs.rmSync(installRoot, { recursive: true, force: true }); }
+    }],
+    ['refuses to recover malformed lifecycle-lock ownership', () => {
+      const { acquireLifecycleLock } = require('../../scripts/lib/nasiko-release');
+      const installRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'ecc-nasiko-malformed-lock-'));
+      const lockPath = path.join(installRoot, '.ecc-nasiko-lifecycle.lock');
+      try {
         fs.writeFileSync(lockPath, '{"pid":"unknown"}\n', { mode: 0o600 });
         assert.throws(
           () => acquireLifecycleLock(installRoot, fs, { isProcessAlive: () => false }),