Omitting the --algo flag lets a lone node elect itself leader on a five-member topic

Both denominators are defensible in isolation. That is the trouble. The BFT path computes its quorum over the workers who showed up, so two nodes both voting red make 2/2, which is 100 percent and clears a 2/3 weighted bar with room left over ^[7][16]. Unanimity among any subset passes, and the size of the topic never enters the arithmetic. The Paxos path counts against the stored acceptor set instead: five members, simple majority of three, so the same two votes are turnout 2/5 and the round is held ^[6][17]. The stdin is identical in both runs. The divergence is whether one word survived the trip to the call site ^[5]. The exit code was the most confident thing in the system ^[5].

The reverse direction is the one that should decide the design. On a topic established under BFT, the Paxos code had no acceptor list under its own keys to read, so `accepts=1/1` is a majority of one computed over the only node present ^[10][18]. The five known members were not consulted, because from that path's point of view they were somebody else's keys ^[9][10].

This is why the guard did not fire. The suite asserts that a lone acceptor can never print `chosen`, and that assertion is real and has always passed, because the suite drives the Paxos path against a Paxos topic ^[11]. A guard's scope is its code path. The state file's scope is the topic. Split-brain had already been closed at the denominator and closed at the write with a lock and an atomic rename ^[12], and both of those are correct pieces of work that do nothing here.

The tool's author, writing on dev.to, declines to file this as operator error, and the reasoning holds: BFT tolerates nodes that lie and pays a 2/3 weighted supermajority for it, Multi-Paxos tolerates nodes that crash and settles for a majority of a known set, and neither is sound over state the other has been editing under different rules ^[13]. A topic that alternates between them holds neither guarantee rather than the weaker one ^[14]. The author also notes that the visible symptom is indistinguishable from a genuine algorithm bug ^[15], which is how six weeks go by ^[2].

This is one person's tool and one writeup, so the question is what has to be true for it to reach yours. You need durable per-entity state, a selector that changes how that state is interpreted, that selector chosen fresh per invocation, and no code reading across the keys that each mode owns ^[3][9]. If all four hold, the algorithm proof is not the thing to re-check. The fix I would take is to write the selector into the same file at topic creation and fail any round whose flag disagrees, then add one reader over the union so `last_chosen` and `last_consensus` disagreeing is an error rather than two successes ^[8].