[tmosleyIII]

The Safety thresholds card on production has an Organization line pinned at zero, next to a healthy top-tier figure. The verdict card shows the contradiction directly: "Core forks if 4 orgs collude" sitting above "Nodes cut off by 0 orgs".

The network is fine. The reporting is not.

What the scans show

[PythonFbas] Network-wide org splitting set: { organizations: 23, minSize: 0 }

Every scan reports it, while the restricted answers in those same scans are healthy — splittingSetsMinSize of 4, 5 and 2 across the aggregated levels, and splittingSetsTopTierMinSize of 4–6. Only the Organization series is affected; Node, Country and ISP are untouched.

Why zero

min_size: 0 is not an error code and not a safety threshold. It is python-fbas reporting that the FBAS it was handed has no quorum intersection: two disjoint quorums already exist, so zero organizations have to fail for safety to break. app.py turns "No splitting set found" into an error precisely so it never arrives as a zero, so zero always means "already split".

The FBAS being handed over is already split because of how the wider set aggregates. mergeQuorumSetsForOrganizations maps each trusted validator to its organization and skips the ones that belong to none, then always adds a self-reference and clamps the threshold down to the surviving count. An organization whose validators trust keys that no organization claims therefore comes out as threshold 1, trusts [itself] — a quorum of one, disjoint from every other quorum.

Confirmed against the real aggregator:

RESTRICTED (core only):            Core A: 2 of [Core A, Core B]
                                   Core B: 2 of [Core A, Core B]

NETWORK-WIDE (core + peripheral):  Core A: 2 of [Core A, Core B]
                                   Core B: 2 of [Core A, Core B]
                                   Peripheral: 1 of [Peripheral]   ← self-satisfying

NetworkScanner feeds this path every validating node (103 → 23 orgs) rather than the 33 core nodes (→ 11 orgs), so the wider set is exactly where these peripheral organizations enter. Nothing caught it either: validateAggregatedNodes only rejects threshold <= 0 and empty quorum sets, and threshold: 1, validators: [self] passes clean — which is why the logs show no aggregation warning.

The two fixes

a1a22b0 — stop the aggregation manufacturing a quorum of one. withoutSelfTrustingGroups drops organizations left trusting nothing but themselves. Deliberately a separate step rather than folded into aggregateByOrganization: the narrow top-tier aggregation has no such groups, and filtering there would silently move a figure that is currently answering its question correctly. Organizations that still depend on the core are kept, so the feature keeps doing its job.

8cf6dc1 — never publish zero as a threshold. The override only skipped undefined, so 0 !== undefined meant zero beat the real restricted answer. It now reports "not computed" and lets the restricted figure stand, and logs when it fires so a recurrence is visible rather than silent. Every neighbouring path in that file already avoids emitting zero for this exact reason.

The first commit removes the known cause; the second is the backstop for any other degenerate shape.

Scope note

This is a reporting bug only — no measurement, scan or persistence behaviour changes, and the restricted org-level analysis is byte-identical. Users of the wider figure should see 4–5 instead of 0 on the next scan.

Verification

• Both fixes mutation-checked: neutralising the zero guard fails keeps the restricted answer rather than publishing zero; neutralising the filter fails 2 aggregator tests. Neither test is vacuous.
• 6 new tests covering both fixes, including that a real non-zero wider answer is still used, and that an aggregation with nothing to drop is untouched.
• Full unit suite green: 1175 tests, 245 suites. tsc --build clean, eslint clean, prettier applied.

Not fixed here: the 1Y/30D views will still show the dip back to 2026-10-01, when #65 introduced the override — this corrects the figure going forward, it does not backfill stored measurements.

🤖 Generated with Claude Code