Pre-protest GDELT correlator: do news-mention spikes predict a shutdown 48h later?

Many internet shutdowns are reactive — they happen after a protest spike makes the news. We pulled daily GDELT counts of PROTEST + RIOT mentions for the 29 censorship-heavy countries already tracked by our event-ingest pipeline, computed a 30-day rolling z-score per country, and tested whether today's z-score predicts a confirmed-censorship/mixed shutdown in the next 48 hours. Across 16 countries with enough overlap (>=21 days of GDELT data, >=2 shutdowns in window), 2 cleared our promote-floor of Pearson r >= 0.30 + p < 0.05: Myanmar (r=+0.41, AUC=0.85, n=5 shutdowns) and Nigeria (r=+0.34, AUC=0.97, n=2). Saudi Arabia sits on the line (r=+0.30) but AUC is near-chance (0.48) so we don't count it. Russia and Egypt trend mildly positive (r=+0.10 each) but aren't individually significant on this 121-day window. Promote-floor required 5 significant countries — we hit 2 — so the model ships as promoted:false. We expose every country's number anyway, because the underlying signal is real for Myanmar and the methodology is transparent enough for downstream consumers to use the per-country significance flag. Pipeline already wired to a 04:15 UTC GDELT ingest + 04:30 UTC correlator rebuild cron. Live at GET /v1/sentinel/pre-protest-signal/{info,leaderboard,<cc>}. Honest caveats baked into every response: GDELT counts mentions not events, per-country baselines are narrow (30d), media-blackout countries have biased z-scores, correlation != causation.