This paper turns Cory Doctorow's enshittification thesis, the claim that platforms decay by first courting users, then shifting surplus to business customers, and finally extracting from both once each side is locked in, into a theorem. The platform is modeled as the controller in a two-sided Substrate-Control Game. The two sides are users and vendors (or creators), and the state variables are their reconstructable off-platform substrates: the material, informational, technical, institutional, and relational base that makes an off-platform alternative actually executable, such as direct audiences, portable identity, interoperable protocols, independent discovery, payment rails, archives, seller lists, reputation systems, and practical know-how. The platform action is always feasible; the off-platform action for each side is feasible only while that side's substrate exceeds a moving threshold that the platform's own conduct can raise. The organizing distinction is between wanting an alternative and having one: a user may prefer an open web and a seller may prefer direct customer relationships, but those preferences do not make the alternative feasible once the platform has destroyed the underlying substrate. Feasibility is therefore endogenous, and current behavior moves tomorrow's menu. The paper composes two mechanisms from the author's companion manuscripts. The first is the substrate-game apparatus, which supplies endogenous feasible-set collapse, radical monopoly, and revealed-preference invisibility. The second is the dynamically-stabilized certainty trap (DSCT), which supplies a post-lock-in extraction mechanism in which a strategic evaluator holds a learner's engagement value at an outside-option indifference point while engagement persists. These are combined into a single two-sided platform model. The result is explicitly conditional rather than universal: it does not assert that every platform must decay or that every real exit failure has literally crossed into infeasibility, but instead identifies a class of transition laws, feedback controls, and audit limitations under which Doctorow's narrative is a theorem, and it carefully separates three states that are usually conflated, namely competitive markets with reconstructable alternatives, recoverable radical monopoly, and terminal extinction, each with its own remedy type. The central construction is that the extraction phase is causally coupled to the erosion phase rather than merely sequential. The paper defines each side's reservation value as the value of its best remaining non-platform fallback, and proves that once the original off-platform action leaves the feasible menu the reservation value drops by an amount bounded below by an explicit margin minus a Lipschitz crossing term, so that under an outside-option dominance condition erosion strictly lowers the DSCT participation target on each side. This is the formal content of the claim that the platform can extract more precisely because it first destroyed the outside option whose value used to discipline extraction; under a transferable-extraction-face condition the platform's achievable payoff rises by a stated amount tied to the two reservation-value drops. The main enshittification theorem then assembles a three-phase path with eight labeled properties: subsidized user growth and vendor-side surplus shifts that each keep participation individually rational while dependence stocks rise and substrates fall; finite-time two-sided foreclosure at which both feasibility margins turn negative and dependence provably reinforces rather than offsets foreclosure because the thresholds are nondecreasing in dependence; a taxonomy separating recoverable two-sided radical monopoly from two-sided extinction, with recovery adoption identically zero on both sides when residual availability is zero; current-menu rationalizability of every observed choice along the entire path, so revealed-preference audits pass even though counterfactual alternatives have been destroyed; and post-lock-in DSCT extraction that holds both sides at their degraded participation constraints while joint participation retains positive asymptotic frequency. A remark clarifies the relation to ordinary monopoly: the theorem requires control over the transition law of feasible alternatives, not a single seller, so a platform facing internal competitors that all share the same destroyed outside substrate can still generate radical monopoly, while a legal monopolist whose exit substrates remain reconstructable need not. The joint DSCT is stated with the qualification it requires. Its convergence half is a standard Robbins-Monro argument on each side's sampled subsequence, but its joint-frequency conclusion, that both sides participate simultaneously with positive asymptotic density rather than merely alternating, rests on an explicit conditional-overlap assumption that the paper isolates rather than hides. The theorem gives both the strong form, conditional independence of the two sides' participation randomizations near indifference, which yields a clean product lower bound on joint frequency, and the weaker form, direct conditional overlap bounded below by a positive constant, which suffices for positivity; the Cesàro frequency then follows from the martingale strong law. The extraction corollary shows that optimizing the stabilizing frame mixture over the affine face defined by the two participation-target equalities assigns to the platform every unit of surplus above the degraded targets that the feasible frame set permits. The paper also proves that a two-sided platform is not two independent one-sided locks, and this is its principal structural novelty over prior lock-in models. In the coupled recovery model, user recovery is valuable only if vendors are also available and vendor recovery only if users return, so the recovery functions carry cross-side availability factors that vanish below critical cross-side thresholds. The coupled recovery theorem then establishes, from a locked state with both deficits positive, that demand restoration alone cannot escape the trap, that one-sided stock restoration can fail even when the identical restorations applied simultaneously succeed, that the minimal one-period restoration cost is the sum of both deficits and therefore strictly exceeds either single-sided deficit, and, as the load-bearing new object, that the recovery dynamics linearized in the bad basin have a two-by-two Jacobian with positive off-diagonal cross-side coupling whose dominant eigenvalue strictly exceeds the larger of the two diagonal own-side rates. This Perron-root rate comparison, verified here by direct computation of the characteristic root, means the two-sided basin exhibits a strictly slower critical-slowing mode than either uncoupled coordinate, a phenomenon structurally absent from one-sided lock-in analysis, and it yields the policy corollary that interoperability or portability remedies must in general target both sides of the market simultaneously unless one side already sits above its cross-side threshold. Finally, the paper explains why standard platform audits miss platform decay. Current-menu revealed-preference audits cannot identify historical menu destruction because they observe rationalizability over the reduced current feasible set, not the history by which it was reduced. A two-sided-balanced welfare audit, the kind of surplus-balancing test associated with two-sided-market antitrust reasoning, can pass during the cross-subsidy phase precisely while dynamic outside-option value is being destroyed. And a passive audit restricted to current choices, realized payoffs, and on-path feedback cannot uniformly distinguish the strategic substrate-destruction-plus-extraction path from a benign evaluator inducing the same current menus and the same on-path feedback law, with the finite-horizon induction behind this non-identification given in an appendix and reducing, for finitely many frames, to a zero-conditional-variance measurability condition. The paper draws the policy implication directly: a right of exit is not a preference but a maintained feasible set, and protecting it requires preserving substrates before collapse, measuring them directly rather than inferring consent from participation, hitting coupled recovery thresholds simultaneously after collapse, and auditing counterfactual platform responses rather than accepting passive participation as proof of consent. A scalar appendix exhibits the three feasibility regimes, no foreclosure, recoverable radical monopoly, and stock-restoration-dependent lock, in closed form.
K. Fathi (Sun,) studied this question.
Synapse has enriched 5 closely related papers on similar clinical questions. Consider them for comparative context: