SurfacesConsumeStateNeverProduceIt

The attempt to break a candidate law, made permanent. The law reads *shells consume state, never produce it*, and it came out of read surfaces: the same provider feeding a web page and a terminal. Reading is where it is easiest to be true. Mutation is where it is worth something — a web form arrives as a POST body, a terminal as keystrokes, an agent as a schema-checked tool call, and each is tempted to assemble the resulting state itself because it already holds the pieces. So this is the falsifier, written before the verdict: **the state a surface ends a mutation with must be byte-identical to what the component alone produces from the same request.** A surface that amends, decorates, reorders or synthesizes anything fails it. Nothing here asks whether the output looks right — only whether the surface stayed a consumer. Deliberately not satisfiable by inspection. A surface passes by handing over what it actually ended up with, at the end of its own real mutation path, and letting it be compared against the component run in isolation. If the two agree, the surface added nothing; if they differ, the law is refuted for that surface and degrades to whatever the evidence still supports. Its own limits, stated so nobody reads more into a green run. It compares end states. A surface that produced state and then discarded it would pass, and so would one whose side effects happen elsewhere. What it forecloses is the failure the law is actually about — the surface deciding what the new state should be. And it will go red on a legitimately intercepted interaction. `milpa/live-web` lets a `live.request` listener answer with the `InteractionResult` outright, so the component never runs and the end state is not one it produced. That is a cache doing its job, and it means the law has two readings that part company here: - *state comes only from the component* — refuted, deliberately, by that design. - *the shell authors nothing; it delegates* — survives, and is what the code implements. This asserts the second. Point it at an intercepted interaction and it fails for a reason that is not a defect, which is worth knowing before the red appears rather than after.