Replying to myself to further refine my issues:
Why are there two two columns to the right of every domain?
The left column is for global rules (independent of the currently-visited domain), the right column is for rules specific to the currently-loaded domain. This is strictly inferior to uMatrix, which allows me to set rules for every part of the dns name (e.g. I can easilty switch between settings rules for news.ycombinator.com, ycombinator.com and even for all .com sites). So what's missing: source domain control for the rule(s) I'm currently configuring.
What's more, in uMatrix I could set a hard block on a toplevel domain (say, google.com) and then add a whitelist for a subdomain (say, mail.google.com) which would override the higher-level block. Since UBO only uses block (red)/ignore (grey), this kind of setup is not possible. So what's missing: an explicit allow/ignore/block toggle like in uMatrix.
What is the significance of the +'s and -'s in the various cells?
These are blocked and allowed resources, so there's some level of feedback there. But it seems that CSS resources are not included in those statistics at all, and images do cause a + to be displayed in the domain-specific row but not in the generic "images" row whereas third-party javascript gets a + in the domain-specific row and in the generic "3rd-party scripts row". So what's missing: I want resource type indicators rather than generic "+"
I'll repeat what I wrote as a response to the sibling comment because it seems to be a fundamental UI issue: the UI of UBO still seems geared towards a one-dimensional blocklist and is missing all the controls for two-dimensional control of [domains]x[resource types]. And after years of safely browsing the modern web with uMatrix, I can't imagine going without that control.
--
edit:
To explain a bit more my thought proces behind how I browse the web: I maintain effectively four trust levels in the browser, which are:
(0. not a browser trust level: pihole-style dns rpz blocking)
1. no trust: all outgoing connections to the domain are blocked.
2. static content: html/css/img is allowed to be loaded from the domain.
3. dynamic content: allow javascript and cross-site requests
4. embeddings: mostly used for payment processors, these tend to get very anxious if some things don't work as expected.
My default (uMatrix) settings put the primary domain at level 2 and all third-party sites at level 1. Surprisingly, this still works fine for a lot of sites, at least the sites that I find worth reading. I guess I'm enough of an academic to prefer reading over "consuming" content.
The first trust increase, if needed, is to selectively bump third-party domains belonging to the same first party to trust level 2. This is mostly because CDNs use a different hostname (such as theguardian.com using guim.co.uk for their content, bbc.co.uk using bbci.co.uk). These rules are configured once as I encounter them, then saved so I won't need to worry about it again.
Then there's webshops I frequent, which are by default at trust level 3. But even there, only the first-party domain is at trust level 3, and the payment provider for the site it whitelisted at level 4. But other third-parties are still at level 1 or 2. Even for these sites, I prefer to keep the trust low and only elevate said trust when I'm actually making a purchase.
So, with respect to uBlock Origin: I don't see how it would allow me to switch easily between trust level 2 and 3 for each third-party domain. And as described here, I use trust switching a lot -- it's become an ingrained part of my browsing habit. In uMatrix, the same is actually very easy, I only have a resource-level Deny on javascript and a resource-level Deny on iframe embeddings. Setting a specific domain to Allow will only bump it to trust level 2 because the resource-level Deny's are still in place; to put a domain at level 3 I must explicitly authorize javascript, and similarly for iframes.