So your main complaint now is that the untyped lambda calculus can't pretend to be a hardware random number generator? Are you even paying attention to the discussion? Hardware random number generators aren't a PHP feature. The question wasn't "can a lambda expression correctly simulate the hardware of an entire web server?".
Your objection to state cookies is spurious. The state cookie is opaque outside of the lambda expression, all the hard work happens _inside_ the lambda expression. If the state held between requests is small and client-specific you can sidestep this altogether by asking the user agent to hold on to it for you, in your HTTP response. In fact you may recall that recently Microsoft ASP.NET was found to have introduced a serious security vulnerability by transmitting inadequately encrypted session state in user-accessible HTTP cookies.
It's certainly not fair to pretend that most, or even many web sites depend somehow upon the "state of the whole world". Usually there's a modest database, and perhaps some files stored on disk. A pure functional system could easily wrap all that material into the state cookie. Many sites _appear_ to integrate content from several other systems, but actually that's usually done client side in the user agent these days, the "integration" from the point of view of PHP or our hypothetical lambda expression is just a few lines of unchanging plain text returned in the HTTP response.
There are numerous _practical_ problems which keep web sites from being built out of say, pure Lisp, but theoretically there's no real obstacle.