Where the partial flag is born

L19's very first aggregation step was "drop partial cells — multisig signer derivatives." We took that on faith. This lesson is where those cells come from. The story is small and elegant: most DeFi admin power doesn't sit behind one key, it sits behind a Gnosis Safe — a k-of-N multisig. The engine takes a cell pinned to the Safe and fans it out to the individual signers, so you can see which human keys carry the risk — without ever double-counting the dollars.

1 · The fan-out

expandMultisigAnchors (at_risk_multisig.go) scans every existing cell. When a cell's entity is a node of kind multisig, it becomes an anchor, and the engine spawns one signer cell per Safe owner:

Each signer cell is a copy of the anchor with three changes:

frac := c.AtStakeUSD / float64(threshold)   // k-of-N → divide by k (the THRESHOLD, not N)
&Cell{
    Entity:    owner,                       // the signer key, not the Safe
    AtStakeUSD: frac,                        // fractional share
    Partial:   true,                        // ← THE flag L19 drops
    AnchorOf:  strPtr(best.anchorID),        // back-pointer to the Safe
    ViaRole:   strPtr("signer"),
    NSigners:  intPtrFromInt(best.nOwners),  // N (for context)
    // role/caps/severity/scope_market/oracle_ltv all inherited from the anchor
}

2 · The point of partial: forensics without double-counting

Here's the resolution of L19's loose end. Those five signer cells share the anchor's value_pool_id (they're keyed identically to the anchor, just with the owner swapped in — see dedupCellKeyForSigner). So in the rollup:

3 · The override: when a signer is also a direct admin

One real edge case. A Safe owner might also hold a direct admin cell on the same target (they're personally a key-holder and a Safe signer). The engine doesn't blindly add a second cell — the signer key already exists in the cell map. Instead:

if best.frac > existing.AtStakeUSD {     // only if the signer share is LARGER
    existing.AtStakeUSD = best.frac
    existing.Partial   = true             // downgrade the direct cell to a derivative
    existing.AnchorOf  = strPtr(best.anchorID)
    existing.ViaRole   = strPtr("signer")
    overridden++
}

The direct authority stays visible, but gets correctly relabeled as a signer derivative when the Safe share dominates. Otherwise (direct authority is the bigger, more dominant signal) it's left untouched. And when a signer sits on multiple anchors for the same key, the code keeps the largest fractional share — the worst case, the same max-discipline as everywhere else.

4 · Oracle anchors expand too (the L20 tie-in)

Remember L20's per-(oracle, market) oracle cells with scope_market, oracle_ltv, and oracle_other_borrowable_usd? If such a cell's entity is a Safe, its signer cells inherit all three, so extractable recomputes against the same consuming market (min(at_stake × LTV, other_borrowable)) — just with the signer's fractional at_stake. And because oracle cells use the 5-tuple key (L20), the signer key is built the same way, preserving the value-defining-ness. The two subsystems compose cleanly:

// the Safe at 0x21f73D…73CA aggregates ~$4.5B at_stake across 7 RWAs;
// post-#89, its 9 signers each get a partial-authority share —
// today the full at_stake attributes to the Safe as one 'admin' entity.

What you can now do

• Explain multisig expansion: a multisig-entity cell becomes an anchor, fanning out to one signer cell per owner.
• Justify at_stake / threshold — divide by k (collusion count), not N, so k signers recombine to the anchor.
• Resolve L19's loose end: partial cells share the anchor's value pool and are dropped to avoid double-counting, but persist as AT_RISK edges for per-key forensics.
• Describe the override (downgrade a direct-admin cell to partial only when the signer share is larger) and the largest-share-wins rule.
• Explain how oracle anchors expand with inherited scope_market/LTV — composing L20 and this lesson.