# Extraction ownership and results

Core owns `ERR_ExtractionService` independently of mission progression and HQ. The scenario registers one physical extraction vehicle during preparation. The service refuses subsequent assignment, including after loss. It never spawns a replacement. Once sites are prepared, starting the service validates the escape boundary and checks for a helicopter controller, pilot position and at least twelve pilot/passenger compartments. An unsuitable transport or invalid boundary prevents player spawning and rolls back authored site content.

`ERR_GameMode` ticks extraction before the empty-server pause, so a lost helicopter or a reserved disconnected occupant reaching the boundary can still resolve. Radio progress and normal mission work retain their empty-server behavior. Loss is terminal throughout the active mission, including prison and radio phases. Waiting until extraction to discover that its only helicopter is gone is no longer necessary. The mode publishes a specific replicated status/debriefing reason for helicopter loss or no remaining survivors.

During extraction, the service checks the registered vehicle's position against the boundary and each registered participant's actual compartment occupancy. Boarding alone, crossing before the extraction phase, a dead occupant, a survivor left behind, or an unregistered NPC cannot produce a winning identity. Living unconscious occupants and reserved disconnected occupants can escape. The first qualifying boundary crossing freezes the identity snapshot and emits one `OnResolved` event; subsequent ticks do not award additional escapees.

Results belong to backend account identities. `ConnectedWinners` maps those identities to their current authenticated connection records and rejects recycled IDs. It is an adapter for the native game-end API, whose transient ID array is not a durable result store. Successor UI delivery uses a replicated controller result derived from the server identity snapshot and tagged with the current mission replication ID. Audit/binding resets and republishes it; the end screen ignores stale native winner IDs and refreshes after delayed result updates. The actual local-controller/native-widget fixture passes; real reconnect/replication acceptance remains separate.

## Native development checks

`--project core --smoke extraction-capacity --rounds 1` uses real vanilla character entities and the authored Mi-8, with an isolated synthetic identity roster. The transport exposes 17 pilot/passenger positions; twelve characters successfully occupy separate native seats. A second case kills one occupant, disembarks another, makes a passenger unconscious, and reuses a disconnected account's connection ID for a different character. The expected partial result distinguishes ten living aboard escapees from three non-escapees; reconnect mapping follows identity rather than the recycled ID.

This fixture requests its own end-of-test reset. Its use of native compartments, scripted consciousness and synthetic records does not establish manual boarding, piloting, medical treatment, twelve network clients, actual reconnects or UI replication.

`--project core --smoke early-helicopter-loss` destroys the registered helicopter during prison while the actual local prisoner is alive. It expects the normal mission tick to reach defeat with the specific loss reason.

`--project core --smoke extraction-startup-failure --rounds 1` substitutes a real vanilla vehicle with insufficient seating only in the fixture's in-memory catalog. `extraction-boundary-failure` uses the proper helicopter with an invalid radius. Both are negative startup tests: they must retain PREPARING, withhold players and clear authored population/stock/scenery. Their expected startup ERROR is retained in the archived native report.

The integrated [040928 native run](evidence/native-2026-09-19-040928/report.json) has 100 passing assertions across capacity, partial results, result widgets and time settings/progression, with no script/VM exceptions. Seven inherited vehicle resource errors remain.