The control that mitigated nothing

Before you start

You inherit a control library that grew by accretion: every control was added for a reason once, and nothing has ever been removed. Your workspace is the lab's working directory, staged exactly as `bash setup.sh ./work` leaves it — the team's owned top-threat list, the controls actually run, a seed coverage map with honest mitigation labels, and the validator. The "Run validator" button IS the lab's `bun validate-coverage.ts work/coverage-map.csv …` step: a port of the committed validator, CI-verified byte-for-byte against real `bun` runs of that script, and it always evaluates your CURRENT files — the failure you start from and the pass you end on are both earned, never scripted. Module 00 asked whether one claim (a laptop's disk is encrypted) was true; this lab asks the question that decides whether such a control deserves to exist at all: which threat does it make less likely or less damaging? One honesty note: the validator and this page's checks are structural floors — the verdict sentences are yours to mean.