Shutdown Duration Forecast

Random Survival Forest (RSF) is the survival-analysis equivalent of a random-forest classifier. Each tree splits the data to maximize the log-rank statistic between child nodes (instead of the Gini impurity a classification forest would use), and the ensemble averages cumulative hazard functions. Output is a full survival curve S(t) per row — we report the median (S(t)=0.5) and the P25 / P75 quantiles as a conditional-on-shutdown interval.

Censored observations are incidents that haven't ended yet (status = active) or that we only observed at a single point in time. For these we know only a lower bound on the true duration. Survival models specifically handle this — a censored row at 5 days tells the model "the true duration is at least 5 days," not "the duration is exactly 5 days." Treating censoring as the true endpoint would systematically under-estimate long shutdowns.

Concordance index (c-index) is the survival analogue of ROC AUC. For every pair of comparable rows it asks: did the model rank them in the correct order? Random guessing is 0.5; perfect ranking is 1.0. Our test-set c-index is 0.545.

Training set: 343 incidents from voidly_data.db with incident_type ∈ {censorship, mixed}. IODA disruption rows are excluded — see the 2026-05-21 forecast labelling fix in CLAUDE.md. Censoring rate 78% — most rows are still open (status = active) and contribute a right-censored signal to the trees.

Honest caveats:

• Single-point observations get a 24h floor before censoring kicks in. If we only ever observed an incident on one day we encode the partial information "at least 24h" rather than 0h.
• We treat status="active" as right-censored even when the incident may have actually ended weeks ago and just hasn't been marked resolved. This biases the model toward over-estimating duration for cohorts dominated by stale active rows.
• The 78% censoring rate is high — c-index from a survival model with this much censoring is less stable than the equivalent classification AUC. Treat the IQR seriously.
• Country features collapse to risk_tier + continent — we do not have enough per-country events to learn a country-specific hazard. Two countries in the same tier + continent will get similar predicted durations unless they diverge on severity, type, or prior-shutdown count.