Reference: outcomes

Status: stable. The outcome enum is part of the contract and changes only with a contract version bump.

Every membrane response carries an outcome value drawn from a small, stable enum. This page is the authoritative description of each value.

The enum

type MembraneOutcome =
  | "admitted"
  | "refused"
  | "pending"
  | "projected"
  | "verified"
  | "candidate_pending"
  | "queued"
  | "executed"
  | "failed";

Source: sdk/ts/src/index.ts + contracts/gestalt-cloud-membrane.v0.json.

Each value

`admitted`

The proposed atom was committed into the named reality.

Used by: intent.commit, shop.commit, vertical.de.invoicePaymentAdvisor, reality.commit, economy.invoice, economy.paymentObservation, economy.bookkeepingFact, economy.periodClose, authority.hostedOperator.grant, authority.package.activate, evidence.connector.ingest, closure.surface, humanAuth.verifyPasskey, humanAuth.faceMatchFallback, authority.presenceApproval, capability.publish.

When you see admitted, the body carries the new atom ref(s) and the receipt carries the admission proof.

`refused`

The proposed act could not enter the cited reality. The body carries a structured refusal:

{
  "failedGate": "<which gate refused>",
  "missingEvidence": [...],
  "requiredIntervention": [...],
  "refusalReason": "...",
  "remedyHint": "..."
}

A refusal is not an error. It is a governed finding. See refusal-codes.md.

Used by: most operations.

`pending`

The act is not yet decided. A pending action has been opened awaiting:

a higher-signing vessel,
additional evidence,
a professional intervention (advisor opinion, attestation),
an external authority signal.

The body carries a pendingAction ref. A separate signing vessel later resolves the pending action into either admitted or refused.

Used by: intent.precheck, intent.commit, shop.prepare, shop.commit, vertical.de.invoicePaymentAdvisor, humanAuth.verifyPasskey, humanAuth.faceMatchFallback (for some configurations).

`projected`

The atom was admitted into a projected reality only. It does not exist in record. Promotion (reality.promote) is the path from projected to record.

Used by: reality.fork, reality.commit when targeting a projection.

`verified`

A non-mutating call succeeded. Used for probes, queries, and verifications.

Used by: tenant.self, commit.recent, m7.state, refusal.codes, runtime.health/ready/version/metrics, receipt.verify, proof.bundle (when entitled), zeitgestalt.query, tension.query, evidence.connector.status, humanAuth.challenge, authority.resolveContext.

`candidate_pending`

A production-scope evaluation matched the bounded admission scope in dry-run but production admission remains globally disabled. The body carries the evaluator decision and the missing-evidence citations. The runtime never returns this outcome from a state-changing operation; it is a production.scopeEvaluate-shaped result that says “this candidate would clear the scope contract once production admission is on.”

Used by: production.scopeEvaluate.

`queued`

The call was accepted into a durable outbox but not yet executed. Used exclusively by effect.intent. The intent is durable; dispatch is a separate operation.

`executed`

A queued effect was dispatched successfully. Used by effect.dispatch. The body carries the effect attempt and effect receipt refs.

The external act is recorded as performed. With the production runtime, this will mean the external system was contacted exactly once. Today it is a fixture record.

`failed`

A dispatch was attempted and failed. Used by effect.dispatch. The body carries an idempotent attempt record. Subsequent dispatches with the same idempotency key add additional attempts but never duplicate the external act.

A failed outcome is not an error. It is a recorded operational fact: the system tried to do the external thing and something downstream went wrong.

Outcome by family (cheat sheet)

Family	Possible outcomes
Probes (`/health`, `/ready`, `/version`, `/metrics`)	HTTP 200 (no membrane outcome)
`tenant.self`, `commit.recent`, `m7.state`, `refusal.codes`	`verified`
`intent.precheck`, `intent.commit`	`admitted`, `refused`, `pending`, `verified`
`shop.prepare`, `shop.commit`	`admitted`, `refused`, `pending`
`vertical.de.invoicePaymentAdvisor`	`admitted`, `refused`, `pending`
`capability.publish`	`admitted`, `refused`
`capability.policy.evaluate`	`verified`, `refused`
`authority.resolveContext`	`verified`, `refused`
`authority.hostedOperator.grant`/`revoke`	`admitted`, `refused`
`authority.package.*`	`admitted`, `refused`, `verified`
`authority.presenceApproval`	`admitted`, `refused`
`authority.sessionRevoke`, `authority.keyRotate`	`admitted`, `refused`
`effect.intent`	`queued`, `refused`
`effect.dispatch`	`executed`, `failed`, `refused`
`economy.*`	`admitted`, `refused`
`evidence.witness.fixture`, `evidence.connector.ingest`	`admitted`, `refused`
`evidence.connector.status`	`verified`
`proof.request`	`verified`, `refused`
`proof.bundle`	`verified`, `refused`
`receipt.verify`	`verified`
`humanAuth.challenge`	`verified`
`humanAuth.verifyPasskey`, `humanAuth.faceMatchFallback`	`admitted`, `refused`
`reality.fork`	`projected`
`reality.commit`	`admitted`, `refused`, `projected`
`reality.diff`	`verified`
`reality.promote`, `reality.discard`	`admitted`, `refused`
`closure.surface`	`admitted`, `refused`
`tension.query`, `zeitgestalt.query`	`verified`, `refused`

How a Koerper should branch on outcome

switch (response.outcome) {
  case "admitted":
  case "verified":
  case "executed":
    // success path: the operation completed and produced its expected effect
    break;

  case "projected":
    // the atom went into a projection, not record
    // surface this clearly to the operator; do not display as record-true
    break;

  case "queued":
    // the effect intent is in the outbox; show "in progress"
    break;

  case "pending":
    // a pending action was opened; show "awaiting <higher signing | advisor | evidence>"
    // the operator may need to switch device, request advisor input, etc.
    break;

  case "refused":
    // structured refusal; surface response.body.failedGate and the
    // remedyHint; do not display as a generic error
    break;

  case "failed":
    // an external dispatch attempt failed; show "attempt failed"
    // the system will not silently retry; you may need to dispatch again
    break;
}

What outcomes are not

Not HTTP status codes. A successful MembraneResponse is HTTP 2xx. The outcome inside is the governance verdict, not the transport status.
Not error codes. refused and failed are governed facts, not bugs.
Not booleans. Multiple values are valid for one operation; do not collapse them to “ok / not-ok.”

Reference: outcomes

The enum

Each value

admitted

refused

pending

projected

verified

candidate_pending

queued

executed

failed