A raid you can leave
Everything was in place except an ending.
You could drop into a raid, find a weapon, shoot someone, and pick up what they dropped. What you could not do was leave. And a raid you cannot leave is a sandbox. There is no moment where the loot in your bag becomes yours, so there is nothing to lose by pushing one more room. The risk calculation the entire genre runs on simply does not exist.
Five seconds of standing still
Standing in an extract zone for five seconds leaves the raid. That is the whole mechanic, and every detail of it is about making those five seconds expensive.
Leaving the zone resets the hold rather than pausing it. This matters more than it sounds: if the hold paused, you could pay for your exit in instalments, ducking out to cover whenever someone shot at you, then stepping back in. A reset means the last five seconds have to be clean ones.
Dying cancels it, and the ordering is deliberate. If you are killed on the tick the hold completes, you die, and everything you were carrying lands on a body for whoever killed you. The near-miss has to be a real loss or the tension in that last second is fake.
Two bugs that had been sitting there
Writing tests for extraction found two things, both of which had been true for some time and neither of which anything had reported.
The built-in level had no extracts at all. The list was empty for the level the server actually hosts, which means extraction could never have fired there even once. Nothing complained, because a separate code path handled spawning and quietly worked.
Players spawned directly on top of the extract points. This was not an accident. It was an explicit design decision, written down as "a raid starts at the points it ends at". It reads fine until exits go live, at which point a player who never touches the controls extracts by themselves after five seconds with an empty bag.
The first fix attempted was an arm delay, so exits would not accept anyone for the first few seconds. That only postpones the problem; it does not make starting on the exit correct. Entry moved to its own set of spawn points, and the map format grew an entry line so a loaded map can say where players come in rather than reusing its exits.
That change had a tail. Two different functions computed spawn positions, and for exactly one commit they disagreed, caught by a test that runs the hosted server and a bare simulation side by side and asserts they produce identical state.
Exits you can see
Only the map editor drew extract points. In the actual game they were unmarked patches of ground you either knew about or did not, which is a knowledge check rather than a decision.
They are now four emissive posts at the zone edge. The interesting part is where the geometry comes from: not from the compiled-in level data, but from the same source the rest of the world is built from. Reading the built-in level while the server runs a loaded map is precisely what once produced a bug described in the code as "spawn me into the original factory with no enemies".
The boundary this is careful about
Extraction returns a plain value: who left, on which tick, through which exit, carrying what. It has no side effects and it writes nothing.
That is deliberate, and it is the seam where persistence will eventually attach. The simulation reports the outcome and something outside it decides what banking means. Putting persistent state inside the world hash would couple determinism to a database, and determinism is the property that makes every desync reproducible. It is not something to trade for convenience.
One test left failing, on purpose
A weapon test fires 40m along the spawn's facing to check that hip fire falls off with distance and scoped fire does not. With the new spawn points there is now a wall 37.6m away.
The scope is fine. The test borrowed the player spawn as an improvised firing range, and it needs its own. It is recorded as failing rather than fixed, because the alternative is choosing spawn points that suit a weapon test, and that is the tail wagging the dog.