# Evidence levels

URL: /concepts/evidence-levels

Foxborne labels what a report says with one of four levels: observed, correlated, hypothesis or unknown. The level tells a reviewer how the evidence supports each statement, with no confidence percentage.



A failure review mixes what the logs show, what lines up in time, what someone suspects and what nobody can tell. Foxborne gives each its own evidence level, and the console draws each level with its own shape.

<Figure caption="The four evidence levels, each with an example from INC-0142 and the places it appears.">
  <EvidenceLadder />
</Figure>

## What each level claims [#what-each-level-claims]

### Observed [#observed]

A value, event or log line captured directly. "perception.service exited at 14:32:04.133" is observed: the companion journal holds that line, and the report cites its file, line and hash. Rules report at this level, because a rule states only what the sources show.

### Correlated [#correlated]

Events that line up inside a known error bound. In INC-0142 the next heartbeat was due at range control 0.76 s after `mavlink-router.service` stopped, against a bound of ±0.43 s, so the order holds. Correlated stops short of cause: no log line shows the stop causing the silence.

### Hypothesis [#hypothesis]

An explanation that still needs a check. INC-0142's finding proposes that the router unit is bound to the perception unit, and calls that binding "a hypothesis until the unit files are checked." The report's **6 Next check** names the test that would settle it.

### Unknown [#unknown]

Sources are missing or partial, or they disagree on time. The last `obstacle_distance` sample and the kernel kill in INC-0142 are 39 ms apart, inside a 46 ms combined bound. Nothing supports an order between them, and Foxborne says so instead of picking one.

## Where levels appear [#where-levels-appear]

| Where                | Levels used                                                 | Set by                                |
| -------------------- | ----------------------------------------------------------- | ------------------------------------- |
| Rule wording         | **Observed:**, or &#x2A;*Warning:** for `clock_uncertain`   | The rule. Its wording is fixed.       |
| The report's finding | **Observed**, **Hypothesis** or **Unknown**                 | The engineer, in **Edit the finding** |
| Sequence lines       | **Observed** by default, or another level saved with a note | The report                            |
| Order-unknown pairs  | **Order unknown**                                           | Foxborne, from the clock bounds       |

**Rule wording** begins &#x2A;*Observed:** in 12 of the 13 rules. `clock_uncertain` begins &#x2A;*Warning:** instead, because it reports a limit on ordering between sources rather than an event.

**The finding** gets its level from the engineer, in **Edit the finding**, whose hint defines the three choices:

> Observed means the sources show it directly. A hypothesis explains the observations and needs a check. Unknown means the evidence cannot decide.

Correlated is not offered for the finding. It belongs to sequence lines, next to the bound that supports it.

**Sequence lines** start as **Observed**, and a line can carry another level with a note. INC-0142's telemetry gap is **Correlated**: "Due 0.76 s after mavlink-router.service stopped. Bound ±0.43 s including link latency."

Foxborne labels **order-unknown pairs** itself, so nobody has to remember the caveat. When two events in the sequence sit inside their combined clock error, both lines read **Order unknown**. E2's note in INC-0142 reads "Order against E3 is unknown: 39 ms apart, inside ±46 ms combined."

## How levels look [#how-levels-look]

The console and the report draw each level with a fixed shape, so a level reads without relying on color:

| Level                           | Shape                   |
| ------------------------------- | ----------------------- |
| <Evidence level="observed" />   | Filled square           |
| <Evidence level="correlated" /> | Two overlapping squares |
| <Evidence level="hypothesis" /> | Dashed square           |
| <Evidence level="unknown" />    | Hatched square          |

The report puts a level chip on the finding and in the **Level** column of the sequence. Its **4 Limitations** section then says in plain words why anything is unknown, such as "Their order is not claimed."

## Why there are no confidence percentages [#why-there-are-no-confidence-percentages]

A figure like 91% needs a calibrated model and labeled incidents. Without both, a percentage is a number nobody can check, and a reviewer would have to take it on trust.

A level makes a narrower promise that a reviewer can test. Observed points at a line in a file, and correlated points at two events and the bound between them.

Hypothesis points at the check that would settle it. Unknown points at the missing source or the overlapping bounds. Reviewers get the evidence itself, which is what they sign off on.

## Related [#related]

* [Alignment and event order](/concepts/alignment) explains when two events are ordered and when their order is unknown.
* [Reports and case files](/concepts/reports) shows where each level sits on the page.
* [Write and review a report](/investigate/write-a-report) covers choosing the finding's level.
* [Rules and findings](/concepts/rules-and-findings) covers the fixed rule wording.