On Dusk, the batch runner hits “submit” and still doesn’t know what survives the window.
They queued it as a batch anyway. CSV frozen. Counts matching. Everyone did the careful thing up front: screen the list, lock the rule, hand it off like it’s done.
Every other system lets you pretend the list stays true.
Dusk doesn’t.
It looked clean when it was assembled. Every address passed at the time. Every account qualified at the time. Nothing shady. Nothing rushed. Just bulk work waiting its turn while the clock keeps doing what clocks do.
No warning.
The first chunk lands and the dashboard gives you that soft, dangerous confidence. 10/10. 20/20. The usual rhythm. Somebody in chat posts the running count like it’s a victory lap.
Then entry 37 doesn’t show.
Not “failed.” Not “denied.” Just missing. The hash resolves for one viewer set and comes back as empty air for another, like the link never meant them.
Ops calls it “nothing.” Legal calls it “scoped.” Same hash.
“Did we skip one?”
“Maybe it’s still pending.”
It isn’t pending. It’s past.
By the time the batch hits that address, the time-bound restriction it depended on has already tightened. The execution window moved while the file was still “in flight.” DuskVM checks the restriction at execution, not at spreadsheet time, and it doesn’t care that the list looked righteous when it was born.
The batch keeps going. 38 lands. 39 lands. Now you’re staring at a count that’s off by one, and it’s the worst kind of off-by-one: small enough to argue about, big enough to break downstream.
Someone asks the question nobody wants to own.
“Did all of them go through?”
“Most did.”
That’s worse than “no.”
Because “most” turns reconciliation into a scavenger hunt. Which ones. Which scopes can even see which outcomes. Why does Legal have a certificate view that Ops can’t open. Why is Finance asking for the “receipt object” like it’s 2016 and every transition leaves a portable artifact.
Someone pastes the missing reference hash.
Ops: “Can’t open it.” Risk: “I can see an attestation certificate.” Finance: “I just need the number.” A lead types “hold” and doesn’t send it.
The Dusk's committee weight is not the issue here. You can see enough signatures for the paths that qualified. For the one that didn’t, the restriction check returns false in the only moment that matters. There isn’t a cute failure marker to staple to the ticket. No rejection artifact. No banner. Just absence — and under Dusk's Moonlight settlement, absence looks identical to “not for you.”
So people do the usual bad dance.
“Rerun the failures.”
Which failures. The batch didn’t label them. It assumed uniform eligibility across the file because that’s what batch logic is: sameness at scale.
Someone suggests rebuilding the list from the original export. Someone else starts comparing timestamps like they’re negotiable. Someone asks if the restriction can be treated “as of submission.” Nobody answers that out loud, because everyone hears what it implies: freezing the rule to protect a bulk job.
There isn’t a switch in DuskVM for “treat eligibility as-of export.” The restriction check happens where it happens.
They split the file.
First split: “known-good” versus “unknown.” Second split: “visible to this viewer set” versus “we need an authorized person to confirm.” A third person is already writing a new batch runner that checks eligibility closer to execution, and they’re doing it without telling anyone, because the meeting is still arguing about whether the missing one “really failed.”
The chain keeps finalizing other transitions like it’s a normal afternoon. New attestations land in-window. The network looks healthy.
The chain keeps finalizing. The ticket stays open. Someone is still counting rows against a window that already rolled.
The CSV is still open on someone’s screen.
Row 37 is still highlighted.
And the next window is already rolling.