aggregation_bits looks like a field you can group across clients. I tried that, and one gossip payload turned into three strings.
The participants had not changed. The Xatu emitter path had. In one hour, 41,441 of 247,296 content-derived message IDs carried more than one stored aggregation_bits value, while every other parsed attestation field agreed.
The aggregate-and-proof table had three encodings for a real bitlist. Its ordinary-attestation sibling manages something stranger: the column is present, but the gossip object has no bitlist. In 15 minutes, 1,960,559 message IDs still split into two values because one emitter spells empty as "" and another spells it 0x.
Xatu v1.22 added an archive for raw Gossipsub wire bytes. The table uses content-derived message IDs and a replacing merge tree, so it sounds safe to treat count() as a unique-message count.
It is not. In a two-hour mainnet window, 35,806 of 197,889 aggregate-and-proof message IDs survived twice. The second row appeared when the same content ID crossed a 12-second wallclock-slot boundary.
meta_network_name = 'mainnet' used to look like enough of a chain filter. It is not anymore.
In four complete hours after Xatu widened its execution-peer capture, node_record_execution held 3,075 peer IDs under the mainnet label. 637 of them, 20.72%, reported a genesis hash that was not Ethereum mainnet's. The sample contained 116 distinct genesis values in total.
This is not mainnet suddenly splitting into 116 chains. The label belongs to the observation path; the remote peer's genesis is a separate field.