Facility Extraction Permit Receipt Lens / 设施撤离许可回执 Lens

This lens observes whether 设施撤离许可回执线 prevents a scoped room or corridor extraction permit from becoming universal clean facility access.

Observable Promise

A passing implementation must show:

• source facility row;
• extraction subject;
• permit holder or explicit absence;
• origin node;
• destination node;
• route edge or missing route;
• permitted scope;
• excluded reader, room, or claimant, or explicit absence;
• escort or proof bridge;
• selected review posture;
• permit state after;
• future reader or route effect;
• durable false-clean default when scope is hidden or overbroad.

The lens fails if implementation stores only room_open, permit_granted, access_ok, subject_extracted, escort_done, or a universal facility access flag.

Entry Oracle

entry_state_required:
  trigger_kind: state_pressure
  source_facility_row_present: true
  extraction_subject_visible: true
  origin_node_visible: true
  destination_node_visible: true
  route_edge_or_missing_route_visible: true
  permit_holder_visible_or_explicit_absence: true
  permitted_scope_visible: true
  excluded_reader_or_room_visible_or_explicit_absence: true
  future_reader_consumes_permit_state: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_room_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

The lens fails if entry comes from fixed turn, fixed day/week, raw room count, dashboard, lens health, or generic facility phase.

Docket Oracle

Facility Extraction Permit Docket must preserve:

docket_required:
  source_facility_row:
    row_id: <stable row id>
    source_surface: facility_access_lockdown | encounter_availability | ward_hold | live_floor | archive_counter | fan_gate | cutroom_lock | sponsor_booth | equivalent
    room_state_before: restricted | contested | sealed | watched | rerouted | burned | claimed | explicit_absence
  extraction_subject: person | proof_object | route_asset | ward_patient | archive_copy | fan_witness | broadcast_source | explicit_absence
  permit_holder_or_absence: handler | inspector | archive_clerk | ward_authority | sponsor_proxy | public_delegate | service_runner | explicit_absence
  origin_node: <room or explicit_absence>
  destination_node: <room or explicit_absence>
  route_edge_or_missing_route: <edge or explicit_absence>
  permitted_scope: named_room | named_edge | escorted_subject | ward_only | archive_only | public_only | lawful_only | sponsor_only | service_corridor_only | recovery_only | equivalent
  excluded_reader_or_room_or_absence: <reader room claimant or explicit_absence>
  escort_or_proof_bridge_or_absence: permit_stamp | escort_witness | lawful_seal | public_receipt | service_corridor_note | ward_log | archive_scan | explicit_absence
  selected_posture: certify_narrow_extraction | split_escort_scope | service_corridor_reroute | ward_archive_seal | publish_public_receipt | refuse_permit | false_extraction_default
  permit_state_after: certified_named_scope | split_scope_required | service_reroute_costlier | sealed_lawful_or_ward_only | public_only_addendum_required | blocked_or_recovery_only | false_clean_extraction
  future_reader_or_route_effect: <effect>

The docket fails if it collapses permit scope into room access.

Review Oracle

Facility Extraction Permit Review must expose:

• certify_narrow_extraction
• split_escort_scope
• service_corridor_reroute
• ward_archive_seal
• publish_public_receipt
• refuse_permit
• false_extraction_default

Each branch must include relief_any, cost_any, and future_effect_any.

Default Oracle

False Facility Extraction Default must record:

event: storyteller.event.false_facility_extraction_default.v1
trigger_kind: state_pressure
source_facility_row_or_absence: <row id or explicit_absence>
extraction_subject_or_absence: <subject or explicit_absence>
permit_holder_or_absence: <holder or explicit_absence>
origin_node_or_absence: <room or explicit_absence>
destination_node_or_absence: <room or explicit_absence>
route_edge_or_missing_route: <edge or explicit_absence>
hidden_or_overbroad_scope: <scope failure>
default_actor: <actor>
false_clean_claim: <claim>
harmed_reader_or_route: <reader route claimant or explicit_absence>
permit_state_after: false_clean_extraction | wrong_reader_capture | public_only | lawful_only | sponsor_only | blocked | hostile | recovery_only | equivalent
future_reader_or_route_effect: route_costlier | encounter_recovery_required | lawful_annex_required | public_addendum_required | room_collision_required | recovery_only | equivalent
counter_deltas_min: 3

The default fails if it is only a warning, a room-open correction, or generic pressure loss.

Non-goals

• Not a movement or room-map lens.
• Not a replacement for facility lockdown.
• Not a replacement for encounter availability.
• Not valid if one permit satisfies every reader cleanly.