Verdict presentation: a design mockup

Illustrates user-guide.md §7 and ontology.md §6.3. Nothing here is implemented; the data below is fabricated to demonstrate the encoding rules. Every state carries a glyph, a label and a colour, so colour is never load-bearing.

1. The query surface

Move Location from a single network up to the country and watch the headline flip from “no” to “yes” while the denominator grows. That is max being monotone in selection size: widening can only raise the answer, which is why the count and the argmax are not optional decoration.

2. A single finding, artefact first

The state label is present but subordinate. The sentence a reader repeats to someone else is the artefact sentence, and it is the one that survives contact with the operator being described. Mechanism confidence routinely exceeds blocking confidence, so the mechanism leads.

Blocked

m.facebook.com · AS12345 Example Telecom · Italy · 1–14 Mar 2026

DNS resolution for m.facebook.com returned 10.10.34.36, an address inside the provider's own network that does not host the site.

Seen in 37 of 42 measurements from this network over 14 days. Confirmed by a matching blockpage fingerprint (it_isp_blockpage_v2).

What this means for you Your provider's DNS is returning a false address. A different resolver, or encrypted DNS, may reach the site.
Method bogon_not_in_ctrl · rule fired at your provider's resolver · taxonomy v1 · rule country_consistent_blockpage
Contrast the same layout when the evidence is thin. The state changes rather than carrying a confidence caveat, because readers keep labels and discard qualifiers.

Not enough data

m.facebook.com · AS56789 Fifth ISP · Italy · 1–14 Mar 2026

3 measurements over 14 days, from 1 probe. Below the threshold needed to distinguish blocking from an outage.

What this means for you We cannot say. This is not evidence that the site is reachable.

3. State vocabulary

Seven states, matching the focal elements in ontology.md §6.3 exactly, so the model and the interface share one vocabulary. “Not enough data” is hatched rather than tinted, because rendering an empty cell as a pale positive is the most damaging default available here. “Blocked on some networks” is the aggregate-only state: it is the lattice join for a selection containing both blocked and reachable cells, and it exists so that aggregation never has to emit an incoherent (1, 0, 1) triple.

4. Time series

Three rules encoded below: gaps in coverage are drawn as gaps and never interpolated across; the measurement count is always visible as a strip under the axis; and changepoints are marked on the series with their mechanism rather than filed in a separate list. The band is a 90% credible interval, so its width falls out of the measurement count instead of being chosen.
1.00.8 0.60.4 0 no coverage changepoint · dns.injection.blockpage n 0 123144 384139 45 Mar 08Mar 09 Mar 10Mar 11 Mar 12Mar 13 Mar 14 90% credible interval

5. Network × layer matrix

The default view for any multi-network selection. Method and locus vary by ISP within a country, and that variation is usually the finding; collapsing it to one national label destroys it. The HTTP column is hatched throughout because there is no HTTP verdict implemented yet, which is the honest rendering of a missing layer rather than an absent one.
NetworkDNSTCP TLSHTTPMethod