A partial outage in Dusk occurs when the committee’s power shifts from abstract authority to a real liability. The base layer may remain technically “live,” but workflows can stall. Proposals, validations, and attestations continue, and deterministic finality often lands without incident tickets—but releases can still pause. When the committee cannot close cleanly, backlogs turn into policy, and every ratification becomes a named exception.
From the committee’s perspective, the challenge isn’t whether finalization is possible—it’s how conservative they can be before conservatism itself becomes a second failure. Temporary holds accumulate, exceptions get timestamped, and the backlog quietly solidifies into policy. Emergency consensus modes exist for abnormal situations, but “weird” here isn’t a crash—it’s the committee stuck between ratification and stall while the rest of the network waits. Fallbacks don’t remove risk; they transform release into a signed exception.
Liability matters more than liveness. Under partial failure, uncertainty is resolved within the committee, not across the network. Future disputes won’t ask “did Dusk finalize?”—they will ask “who decided it was safe under these conditions?” and whether that decision can be defended without compromising confidentiality. Dusk’s Moonlight-style confidential state transitions restrict escalation; disclosure cannot be widened just because the committee is struggling.
As a result, behavior hardens around a small set of “known safe” operators, acceptance windows widen due to uneven finality, and manual holds happen earlier to avoid post-facto justification. Counterparty limits tighten when committee posture—not market risk—determines whether a transfer can proceed. Over time, holds start earlier—not because anything broke, but because every decision needs accountability.
