Facility Extraction Permit Receipt / 设施撤离许可回执机制

Facility Extraction Permit Receipt turns a successful room or corridor extraction into a scoped custody receipt.

The rule is: a permit can carry only the subject, room edge, reader scope, and future use that it names. It cannot become clean facility-wide access by implication.

Permit row

facility_extraction_permit_row:
  source_facility_row:
    row_id: <stable row id>
    source_surface: facility_access_lockdown | encounter_availability | ward_hold | live_floor | archive_counter | fan_gate | cutroom_lock | sponsor_booth | equivalent
    room_state_before: restricted | contested | sealed | watched | rerouted | burned | claimed | explicit_absence
  extraction:
    extraction_subject: person | proof_object | route_asset | ward_patient | archive_copy | fan_witness | broadcast_source | explicit_absence
    permit_holder_or_absence: handler | inspector | archive_clerk | ward_authority | sponsor_proxy | public_delegate | service_runner | explicit_absence
    origin_node: <room or explicit_absence>
    destination_node: <room or explicit_absence>
    route_edge_or_missing_route: <edge or explicit_absence>
    permitted_scope: named_room | named_edge | escorted_subject | ward_only | archive_only | public_only | lawful_only | sponsor_only | service_corridor_only | recovery_only | equivalent
    excluded_reader_or_room_or_absence: <reader room claimant or explicit_absence>
    escort_or_proof_bridge_or_absence: permit_stamp | escort_witness | lawful_seal | public_receipt | service_corridor_note | ward_log | archive_scan | explicit_absence
  review:
    selected_posture: certify_narrow_extraction | split_escort_scope | service_corridor_reroute | ward_archive_seal | publish_public_receipt | refuse_permit | false_extraction_default
    permit_state_after: certified_named_scope | split_scope_required | service_reroute_costlier | sealed_lawful_or_ward_only | public_only_addendum_required | blocked_or_recovery_only | false_clean_extraction
    future_reader_or_route_effect: <effect>
    counter_deltas:
      relief: []
      cost: []
      future: []

The row is invalid if it stores only room_open, permit_granted, access_ok, extracted, or escort_done.

Branch contract

At least seven outcomes must be playable or explicitly blocked:

• certify narrow extraction;
• split escort scope;
• service-corridor reroute;
• ward or archive seal;
• publish public receipt;
• refuse permit;
• false extraction default.

Every resolved branch must mutate at least one relief surface, one cost surface, and one future reader or route effect.

Default conditions

False Facility Extraction Default fires or arms when:

• a future reader consumes a permit without source facility row;
• origin, destination, route edge, or permit holder is hidden;
• excluded reader or excluded room is missing but not marked explicit absence;
• service-corridor, ward, sponsor, archive, lawful, public, or editor scope is treated as universal access;
• a route asset or encounter becomes available from access_ok instead of scoped permit state;
• raw room count, dashboard state, or lens health declares the extraction clean.

Counter surfaces

Allowed relief surfaces include subject_extracted, proof_seizure_down, ward_harm_down, archive_copy_preserved, public_visibility_up, and route_asset_reached_destination.

Allowed cost surfaces include inspection_heat_up, escort_debt_up, service_corridor_heat_up, runner_risk_up, proof_contamination_up, witness_exposure_up, public_receipt_distrust_up, contract_capture_up, and future_recovery_cost_up.

Allowed future surfaces include certified_named_scope, split_scope_required, public_addendum_required, lawful_annex_required, route_costlier, encounter_recovery_required, blocked_until_room_collision_review, and recovery_only.

Non-goals

• Not a full movement system.
• Not a map replacement.
• Not a general permit economy.
• Not a fixed turn extraction timer.
• Not valid if a single permit cleans every facility reader.