The coverage spine: one control, seven stages, a green gate

Before you start

This is the capstone's guided portion: the coverage spine. Your surface is a simulated capstone repo seeded byte-identically to what `bash labs/setup.sh` writes — the manifest, the seven placeholder stage artifacts, the before/after skeleton — and a "Validate capstone" button that runs the lab's own `validate-capstone.sh`, ported to engine code and CI-verified byte-for-byte against real `bash` runs of that script. Every per-stage line, verdict, and exit code you see here is what the real validator prints on a real machine. Two honest boundaries. First: the engineering artifacts themselves (your collect script, your policy, your scheduled workflow) are built in your real environment per Modules 5–13; here they are the setup script's placeholders, and the work is the manifest-and-validator loop that proves coverage. Second: in this simulation the validator is engine code — you literally cannot edit it to make it pass. On your real machine you could, and §6 task 2 names that as the exact anti-pattern this program teaches against. The control you'll ship is the one this program has carried since week 0: laptop disk encryption — the same claim you watched a Mac answer with `fdesetup status` and a Windows box answer with `Get-BitLockerVolume`. The eight-point checklist above the editor is read from the validator's own output; your job is to make it green, break it in the two ways real capstones break, read the difference, and make it green again — twice.