# Write and review a report
URL: /investigate/write-a-report
Write the finding in your own words while Foxborne extracts the sequence and the exact excerpts beneath it. Limitations and open questions travel with the report, and the named reviewer approves it from the same tab.
The report is the page a review board reads. Its first section is the engineer's conclusion, stamped with the author's name. Everything below it comes from the sources, with the file, location and SHA-256 behind every excerpt. This page covers each section and its dialog, the checklist in the rail and the review, with INC-0142 from the example dataset.
## Before you start [#before-you-start]
* Investigators and admins write reports. Reviewers comment and approve them, and viewers read approved reports. See [Roles and permissions](/security/roles).
* Put the events you need in the sequence from the evidence inspector. See [Work an incident](/investigate/incidents#select-an-event-and-add-it-to-the-report).
## What the report holds [#what-the-report-holds]
The **Report** tab shows the report as a page. From the top:
1. The marking, such as CUI. When the marking is CUI, the designation indicator follows: **Controlled by** for the organization and again for the office, then **CUI category**, **Dissemination** and **POC**.
2. **Incident report**, the incident ID and the title.
3. The header: **Vehicle**, **Run**, **Location**, **Sources**, **Clock**, **Investigator**, **Reviewer** and **Generated**.
4. **1 Finding**, **2 Sequence**, **3 Evidence**, **4 Limitations**, **5 Open questions** and **6 Next check**.
5. The footer, which reads "Generated by Foxborne 1.4.2. Every excerpt can be checked against its SHA-256." The marking closes the page.
| Header field | In INC-0142 |
| ------------- | ----------------------------------------------------------------------------------------------------------------------- |
| **Vehicle** | UAS-04, Q4 recon quad, PX4 v1.15.4 |
| **Run** | R-0931, Route Iron recon, leg 2, with its start |
| **Location** | The place, the site and the MGRS reference, marked **Removed on export** while the redaction policy removes coordinates |
| **Sources** | One line per file with its short hash, such as Companion journal `uas04-orin-journal.json` `sha256:a0741c955f33…cdf4` |
| **Clock** | "All sources aligned. The widest bound between two sources is ±46 ms." |
| **Generated** | The date and time, then "by Foxborne 1.4.2" |
The **Clock** line has three other forms: "Companion clock aligned by hand, ±1.04 s. Other sources GPS or NTP anchored.", "The companion clock is not aligned. No order is claimed between the companion and the flight log." and "Elapsed time only."
## Write the report [#write-the-report]
**Edit** beside **2 Sequence** opens **Edit the sequence**: "Choose the events the report walks through. Each line keeps its source reference." It lists every event of the incident in time order, each with a checkbox, its time, title and lane. Tick the events the report needs.
The report sorts the sequence by time, with events on an unaligned companion clock last, and numbers the lines E1, E2, E3.
| Column | What it shows |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Time, UTC** | The time, with the bound beneath it: ±6 ms, or ±15 ms, latency 412 ms for a receipt. An unaligned companion event reads **own clock** and **no anchor** |
| **Event** | The title, with a note when there is one |
| **Level** | The evidence level. **Order unknown** marks both events of a pair closer than their combined clock error |
| **Evidence** | The reference, E1 to E8 in INC-0142 |
In INC-0142, E2 carries the note "Order against E3 is unknown: 39 ms apart, inside ±46 ms combined." E3 carries the same note against E2. E6, the telemetry gap, reads **Correlated**, with "Due 0.76 s after mavlink-router.service stopped. Bound ±0.43 s including link latency." An empty sequence reads **No events in the sequence yet. Add them from the timeline inspector.**
**3 Evidence** has no edit button: Foxborne builds it from the sequence. Each reference gives the title, then the file, location, short SHA-256, parser and event ID, then the excerpt. A journal event quotes its `MESSAGE`, a JSON record appears compact and a flight log record gives its topic and first three fields.
```text title="3 Evidence, E3" caption="Example dataset, INC-0142"
E3 Kernel killed perception_node (out of memory)
uas04-orin-journal.json, Line 18,314, cursor i=5014, sha256:a0741c955f33…cdf4, journal 0.6.0, event 5a705b4a
Out of memory: Killed process 2213 (perception_node) total-vm:11873248kB, anon-rss:6823516kB, file-rss:10240kB, shmem-rss:0kB, UID:1001 pgtables:14720kB oom_score_adj:0
```
**Edit** beside **1 Finding** opens **Edit the finding**: "One or two sentences, in your words. Say whether it is an observation, a hypothesis or unknown."
Choose the **Level**: **Observed**, **Hypothesis** or **Unknown**. The hint reads "Observed means the sources show it directly. A hypothesis explains the observations and needs a check. Unknown means the evidence cannot decide." Then write the **Finding**. It is required: left empty, it turns red and the dialog stays open. Backticks set parameter names and commands in code.
Saving stamps the finding: **Written by**, your name, the date and the time, then "This paragraph is the engineer’s. Everything below it is extracted from the sources." INC-0142's finding is a hypothesis and says so: "The binding is a hypothesis until the unit files are checked."
**Edit** beside **4 Limitations** opens **Edit limitations**: "Missing topics, dropped data, clock uncertainty and manual assumptions. One per line." Blank lines are dropped. Each limitation shows an icon for its kind: order, latency, missing data, scope, clock or manual assumption.
INC-0142 carries four. The first reads "The last obstacle\_distance sample and the kernel kill are 39 ms apart, inside their 46 ms combined clock error. Their order is not claimed." A manual clock alignment adds its own line, and removing the alignment removes it. See [Align a clock by hand](/investigate/align-a-clock).
**Add** beside **5 Open questions** opens **Add an open question**: "Open questions travel with the case file until someone resolves them." Write the **Question**, which is required, and select **Add question**.
Each question shows its text and who asked it when, with a **Resolve** button beside it. **Resolve** takes effect at once and confirms with **Question resolved**. With no question open, the section reads **None.**
**Edit** beside **6 Next check** opens **Edit the next check**: "One test or measurement that would confirm or refute the finding. Wrap commands in backticks." Left empty, the section reads **Not written yet.** INC-0142's next check starts on the bench unit with `systemctl show mavlink-router.service -p BindsTo -p PartOf -p Requires`.
Each save adds a line such as **Edited the finding** to the report history and records **Edited report** in the audit log. Foxborne confirms with **Saved. The edit is in the report history.**
## Keep observations apart from conclusions [#keep-observations-apart-from-conclusions]
The report separates what the sources show from what the engineer concludes:
* The finding is the only section in the engineer's words, and the page says so under it.
* The finding carries its level, , or , so a hypothesis never reads as an observation.
* Rules report in fixed wording that starts with Observed or Warning, such as "Observed: telemetry receive gap, not necessarily radio failure". The **Rules** page states it: **Rules observe. They never conclude.**
[Evidence levels](/concepts/evidence-levels) explains the four levels and when each applies.
## Check the finding against the records [#check-the-finding-against-the-records]
The finding is free text, so nothing stops a mistyped time or a rounded figure that no record supports. On screen, Foxborne checks it. The [AI models](/concepts/ai-models) list what the finding claims; code then matches each claim to this incident's records. The check marks the text and never changes it.
| Claim | What it is matched to |
| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------- |
| A time, such as 14:17:05 | An event, or a time quoted in an event's values, in that second or millisecond |
| A time difference, such as 1.69 s | Two records that far apart. The order between them must hold outside their combined clock bound |
| A value with a unit, such as 38.6 m/s² | A value a record states, a rule threshold or a run parameter |
| A parameter in backticks, such as `NAV_DLL_ACT` = 1 | The run's parameter set, with the value if one is given |
| A word that states a cause, such as caused or unseated | Whether the sentence, or the finding's level, says the cause is not established |
Each claim is underlined in the finding. A dotted line means it matched; a solid amber line means it did not. Hold the pointer over a claim, or tab to it, for its source. On INC-0142, **34 ms** reads "E5, mavlink-router.service stopped is 34 ms after E3, kernel killed perception\_node (out of memory). Same clock, so the order holds."
A box under the stamp sums it up. On INC-0143 it reads **Checked against the records.** "All 8 figures and times it states match the records; every order it claims holds. Hover a marked phrase for its source." A figure no record supports reads "Not found in the records of this incident. If it was worked out by hand, say how in the finding." A cause written as observed reads "States a cause as observed. The records show order and timing; a cause needs an inspection or a test, so write it as a hypothesis."
The marks and the box are for the screen only. Printing and case files carry the engineer's text as written.
## Open Review and history [#open-review-and-history]
On the **Report** tab, the paper takes the full width of the page. **Review and history**, at the top right beside the status button, opens a drawer subtitled with the incident ID and the report's state, such as **INC-0142, report in review**. **Status** shows the state, **Draft**, **In review** or **Approved**, with the reviewer's name. The drawer's footer holds the buttons:
* **Print or save as PDF**, which closes the drawer and opens the browser's print dialog. The print layout leaves out the console's sidebar, top bar, tabs and header buttons. It also hides every **Edit**, **Add** and **Resolve**.
* **Approve report**, which the incident's named reviewer sees while the report is **In review**.
* **Export case file**. See [Export a case file](/investigate/export).
**Before you export** checks the report. For INC-0142 it reads:
| Check | INC-0142 |
| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Sources | "Every sequence line cites its source (8 of 8)". A warning when the sequence is empty or a line has no source file |
| Order | "No order is claimed inside a clock bound. One pair is marked unknown." |
| Coordinates | "Coordinates are removed on export". The warning form is "Coordinates will be included on export" |
| Open questions | The warning "2 questions are still open" |
| Finding | "Finding: both figures it states match the records; every order it claims holds." A warning when a figure is not supported or a cause is stated as observed |
A manual clock alignment adds the warning "Uses a manual clock alignment, ±1.04 s". **History**, marked **Every edit is audited**, lists every entry with who made it and when, newest first, 8 to a page.
## Review and approve [#review-and-approve]
Read the finding, then check its level against the sequence. For any line you doubt, select the event on the timeline or open its event page, and read the original record. Leave notes on the evidence under **Discussion** on the event page.
Add an open question for anything the evidence cannot answer yet. It stays in the report, and in the case file, until someone resolves it.
When the report is **In review**, open **Review and history** and select **Approve report**. Foxborne confirms with **Report approved. Case files now carry your sign-off.** The report then reads **Approved** in the drawer and beside the **Report** tab, and **History** and **Activity** gain the approval.
The status button in the incident header sets the incident to **Open**, **In review** or **Closed**. It changes the incident, not the report, which keeps its own state.
## Check the result [#check-the-result]
* The finding shows your name, the time and the level you chose.
* Every sequence line has an E number and an entry under **3 Evidence**.
* **Before you export** shows no warning you cannot account for.
* **History** lists each edit.
## Troubleshoot [#troubleshoot]
**Save does nothing in Edit the finding.** The **Finding** is empty and has turned red. Write it and save again. **Add question** behaves the same way with an empty **Question**.
**The sequence reads No events in the sequence yet.** Add events from the inspector with **Add to report**, or tick them in **Edit the sequence**.
**There is no Approve report button.** Only the incident's named reviewer sees it, and only while the report is **In review**.
**The sources check is a warning.** The sequence is empty, or a line's source file is not in the run.
## Next [#next]
Hand the report to someone outside the deployment.
Observed, correlated, hypothesis and unknown.
What a report is for and what it never claims.
How a reader checks every excerpt.