The thread installs Heartbleed as a case in which a missing bounds check on a TLS keep-alive, sitting in a volunteer-maintained library that the internet treated as its TLS stack, leaked process memory for two years. The unresolved question is which repair would have closed that channel when OpenSSL 1.0.1 shipped in March 2012. Funding a half-dozen full-time OpenSSL people, as Marquess asked and CII later began, treats staff as the missing object. Requiring the heartbeat length to match the payload actually received, or not shipping that keep-alive on by default, is a different first rule: LibreSSL forked 1.0.1g six days after the advisory and dropped the DTLS heartbeat. Not treating one volunteer library as the internet's TLS is a third. Those are not substitutes. CRA's about 900 SINs show the overread was used. CII became OpenSSF. The live question is which of those three, required in 2012, would have turned a heartbeat into a non-event.