Dusk Foundation gets ugly when an inter-layer move is already committed on one side and still unacceptable on the other.
A transfer leaves DuskEVM and is supposed to land in DuskVM though. The lock happened. DuskDS finalized the source transition. Everyone can point at the block and say "done' with a straight face.
Then the native bridge tries to carry the message across and the destination lane will not take it.
Not with this attestation certificate. Not in this committee window. Not under the execution context the destination is enforcing now.
So the asset sits in the middle. Not lost. Not settled. It is a live obligation with two truths attached to it: source finalized, destination not admitted. That gap is where operators start making mistakes, because every tool they reach for wants a single label.
Support wants a status. Risk wants a settlement answer. The bridge can only offer “pending” without being able to promise when it stops being pending.
This isn’t a liveness fight between chains. It is one system refusing to treat “final” as a universal passport across its own contexts. If the relay payload is missing whatever the destination expects after a recent ruleset change, or if the attestation doesn’t line up with the window the destination will verify against, the bridge doesnot get to hand-wave it through. DuskVM doesnot accept sympathy.
The hardest part is how quiet the failure is.
No revert fireworks. No obvious red health signal. DuskDS keeps doing its job. Other transactions finalize. The stuck transfer becomes a private crisis because it looks like normal network life with one file jammed in the pipe.
And you can’t fake the intermediate state. If you mint a “looks good” receipt at the app layer and the destination still won’t accept the message, you’ve manufactured an audit problem on top of the operational one.
So the work turns into context matching.
Which execution rules were live on DuskEVM at lock time. Which verification rules are live on DuskVM now. Whether the attestation certificate corresponds to the committee window the destination is willing to accept. You find the mismatch, eventually, and it’s always smaller than anyone wants it to be.
Until it’s fixed, the bridge can’t complete the sentence. The transfer stays parked between DuskEVM and DuskVM, finalized on one side and still waiting to be recognized on the other.
