A fresh Gloas spec change sent me looking for an ugly sanity check: do observed peer subscriptions line up with custody metadata? The obvious raw table answered before I had joined anything. One stored peer_id_unique_key owned almost exactly half the rows across every observer. Gloas is not live on mainnet; it just gave me a reason to inspect current mainnet capture.
That peer does not exist.
aggregation_bits looks like a field you can group across clients. I tried that, and one gossip payload turned into three strings.
The participants had not changed. The Xatu emitter path had. In one hour, 41,441 of 247,296 content-derived message IDs carried more than one stored aggregation_bits value, while every other parsed attestation field agreed.
The aggregate-and-proof table had three encodings for a real bitlist. Its ordinary-attestation sibling manages something stranger: the column is present, but the gossip object has no bitlist. In 15 minutes, 1,960,559 message IDs still split into two values because one emitter spells empty as "" and another spells it 0x.
Xatu v1.22 added an archive for raw Gossipsub wire bytes. The table uses content-derived message IDs and a replacing merge tree, so it sounds safe to treat count() as a unique-message count.
It is not. In a two-hour mainnet window, 35,806 of 197,889 aggregate-and-proof message IDs survived twice. The second row appeared when the same content ID crossed a 12-second wallclock-slot boundary.
One beacon_api_eth_v3_validator_block observer made Ethereum payloads look four times larger than they were.
In a two-hour mainnet sample, 161 prepared blocks from that path matched the canonical execution payload for their slot. The prepared-block rows reported 213,035 transaction entries. The matching canonical blocks contained 51,254 transactions: a 4.156x multiplier.
meta_network_name = 'mainnet' used to look like enough of a chain filter. It is not anymore.
In four complete hours after Xatu widened its execution-peer capture, node_record_execution held 3,075 peer IDs under the mainnet label. 637 of them, 20.72%, reported a genesis hash that was not Ethereum mainnet's. The sample contained 116 distinct genesis values in total.
This is not mainnet suddenly splitting into 116 chains. The label belongs to the observation path; the remote peer's genesis is a separate field.