Diagnostic probes · quarantine panel

Source · Dan, 2026-06-19

"This diagnostic pattern should be preserved … it's a good one. It should be a composable script that can be used easily."

The problem

Every gf.cx surface ships "where am I?" diagnostic endpoints — /ip, /cf, /trace — stamped in by the scaffold as a baseline. Almost nobody hitting them is a reader: they're pinged by uptime monitors, port scanners, headless bots, and your own probes. Left in the analytics, that traffic inflates the top-paths table and buries real reader behaviour.

But just deleting the noise throws away a genuinely useful signal — who is poking the perimeter, and from where. A scanner hitting /ip 70 times from CN/SG/HK is not a reader. It's infrastructure intelligence, and it belongs in a different instrument.

The element, in-page

The panel below is a quarantine instrument, not a reader-facing widget. It renders probe paths in a compact list sorted worst verdict first — a persistent scanner at the top, nominal probes at the bottom. The critical row is expandable on click, revealing country-of-origin chips and scanner-UA classifications. All styles and behaviour are self-contained; the panel is designed to be dropped into any back-of-house dashboard without dependencies. Flip the tabs to read the source.

Where it applies

Any analytics dashboard that ingests Cloudflare request logs — the probe paths are universal across the portfolio since the scaffold baseline stamps them in. Drop the panel alongside the reader table rather than filtering globally.
Status and observability surfaces like status.gf.cx — where you want perimeter-noise visible to the operator but invisible to the page visitor.
Skip it when the surface has no probe endpoints (rare but possible if the scaffold baseline was bypassed), or when probe volume is so low it doesn't justify its own panel — in that case a one-line footnote in the reader table suffices.
Don't serve it to readers. The panel is a back-of-house instrument. Keep it excluded from OG/SEO and from anything a visitor can reach — the same external-probe discipline applied in reverse.

Reusable elements

Status dot + worst-first sort — the radial-gradient dot in red/amber/green and the rule that the highest-severity row always leads. Visually equivalent to an R/Y/G traffic light; copy the dot CSS and the sort key independently.
Expandable detail row — a click-triggered aria-expanded + .open toggle, keyboard-accessible (Enter/Space), chevron that rotates on open. Eight lines of JS, zero dependencies.
Country-of-origin chip strip — .chip inline-flex bubbles for country counts, .chip--scanner variant in soft red for UA classifications. Reuse for any tag-cloud breakdown.
Panel head — the two-token header row (bold uppercase title + monospace sub-label) as a reusable composition header. Works equally well on any collapsible instrument block.
aggregate() + render_panel() contract — the Python module at ~/bin/diagnostic_probes_panel.py: aggregate once from raw Cloudflare rows, render anywhere. Stable dict shape decouples the data layer from the render layer.

Reference

Source: Dan, 2026-06-19 — "this diagnostic pattern should be preserved … it's a good one. It should be a composable script that can be used easily." Extracted from dare_cf_analytics.py's probe section and generalised into ~/bin/diagnostic_probes_panel.py.
In use · example: status.gf.cx — the gf.cx fleet status hub, where the panel first earned its keep filtering /ip · /cf · /trace out of the reader-facing analytics tables. The probe endpoints themselves are stamped in by the scaffold baseline; this panel is their natural back-of-house companion.
Reusable elements: Status dot (radial-gradient R/A/G) · worst-first sort · expandable detail row · country chip strip · scanner-UA chip variant · panel-head composition header · aggregate() + render_panel() Python API.
Origin: dare.co.uk analytics dashboard, 2026-06-19 — where probe noise was first quarantined into its own collapsed <details> panel rather than deleted or left in the reader view.