Operation Lifecycle

An operation is one declared action that Merulan performs the same way on every Surface that offers it. Reading a Record, starting a Run, and sending a message are each one operation. This map follows one call from its Surface to its result. It then shows how to check an effect when the end state is unclear.

Topology

The stages run in this order.

Where an operation call stops — A refused call stops at admission, an admitted call reaches a decision that returns its result or a declared error, and only an unclear effect is read back. Admission checks each call against its declaration.

Stage	What happens	Owner
Declaration	The operation states its input, result, errors, and permission before any call exists	API and each operation's reference page
Admission	Merulan checks the credential, the Workspace, the permission, and the Governance rules	Security, Tags, policy, and field access
Decision	The operation decides its result once	The Capability that owns the operation
Result	The caller receives one result, one declared error, or an internal fault	Each operation's reference page
Readback	An unclear effect is read back before any retry	The Capability that owns the effect

Declaration

An operation has a contract before anyone calls it. The contract says if it reads or writes. It names the input, result, errors, permission, and Surfaces that offer it.

All callers use that one contract. The Console, API, SDK, CLI, MCP, and Infrastructure as Code each send a call to it. A Surface may add a check. It can never remove or replace one the operation declared. It may offer an operation or leave it out. It cannot change what the operation means. The operation reference lists its Surfaces under Available through.

Admission

Admission decides if the call may run the operation. Security checks run first. Governance checks then inspect any value that needs a purpose or carries a Tag. Admission also runs each check the operation or its Surface adds. Nothing is read or changed until admission passes. A refused call reaches no outside system.

Security states the order of the security checks and the repair for each refusal they return. Tags, policy, and field access states the order of its own checks and the repair for a refused purpose or Tag.

Decision and result

An admitted call reaches its decision once. The operation uses its input and what the caller may see. The same caller and input reach the same decision on every Surface.

The caller receives one result, one declared error, or an internal fault. A result holds only values the caller may see. A field withheld by a Tag stays withheld on every Surface. Access reviews and audit states where a reviewer inspects the resulting evidence.

Readback

An operation can return before an outside effect is known. The other system may accept the effect without finishing it. Its answer may also fail to arrive. The result says whether the effect was accepted, or its outcome is unknown.

The operation names the status or reconcile operation that reads it back before any retry. A retry keeps the effect's identity, so one intent never becomes two effects.

Traversal

Start from the stage where your call stopped:

Where the call stopped	Continue to
Refused before it ran	Security
Refused on a value it tried to read	Tags, policy, and field access
Returned a declared error	The operation's reference page, under Errors
Stopped for a person to decide	Reviews and repair
Retried with the same request key	The operation's reference page, under Durable identity

Company Model names the Capability that owns each part of the company an operation reads or changes.
Surfaces explains how each Surface reaches the same operation contract.
API shows the first call and the shape every response follows.