Pre-shutdown network signal detector: do BGP, TLS-reset and new-ASN precursors lead a blocking event?

A user-visible shutdown is the end of a process — by the time domains stop loading, the routing and filtering infrastructure has often already moved. This finding ships a per-country composite "pre-shutdown signal score" built from three technical precursors that TEND to precede user-visible blocking, computed daily over the trailing 90 days. bgp_signal: IODA BGP-datasource critical/warning alert counts (route withdrawals), normalized to that country's own 90-day baseline. tls_fail_spike: TLS / TCP-reset interference evidence rows (http-blocking-tcp-reset etc.) against a trailing 7-day mean — a DPI box being switched on shows here before the blockpage does. new_asn_signal: count of distinct ASNs lighting up with anomaly evidence today that were not seen the prior week — blocking infrastructure spreading. The composite is a 0.5/0.3/0.2 weighted sum, then z-scored within each country so every country is on a comparable scale. We back-tested the composite against 2,240 evaluable confirmed shutdowns (incident_type censorship/mixed/disruption, severity critical) in the window: for each shutdown, did the composite cross z>=1.5 in the 72 hours before the shutdown timestamp? 522 of 2,240 did — a 23.3% true-positive rate, with a median lead time of 31.3 hours (mean 39.9h). The honest other side: of 585 country-days where the signal fired, 180 had no shutdown in the following 72h — a 30.8% false-positive rate. So the signal is real but partial: it clears the promote-floor (>=3 historical shutdowns with >=1h lead — we got 522) and ships as promoted:true, but it catches under a quarter of shutdowns and fires falsely about a third of the time it fires. The reason is structural and stated in every API response: many shutdowns are SUDDEN with no measurable precursor, IODA BGP has a ~6h ingest lag that hides any sub-6h lead, and an elevated composite reflects anomaly activity that frequently resolves without a shutdown. Use it as a supporting signal alongside the 7-day forecast, never as a standalone trigger. Live at GET /v1/sentinel/pre-shutdown-signal/{info,leaderboard,<cc>}. Built by scripts/build-pre-shutdown-signals.py.