The block verdict told you the conclusion but not why, so confirming it
still meant cross-referencing ten raw columns (ch_bytes, ch_accepted,
rx_after_ch, rx_class, close_origin...). Fold the decisive evidence into
the verdict token itself:
block=silent_no_reply:unclear;ch=517/517;rx=0;end=timeout
block=server_tls_alert:client;ch=517/517;rx=7;rec=tls_alert;end=peer
One field now carries the write completion (ch=accepted/intended), bytes
received, the response record class, and whether the peer actively closed
vs our own timeout - the exact inputs the classifier used. No spaces, so
whitespace tokenizers still see one field; greppable by verdict and by
attribution. The flat raw columns stay untouched as forensic backup, so
grep-based analysis keeps working - nothing was removed or nested.
5ac1939521