# Statuses and states
URL: /reference/statuses
Decode any status or chip in the Foxborne console, with the exact text, where it appears and what it means, for incidents, reports, runs, imports, clocks, evidence, rules, sources, collectors, the audit chain and markings.
Chip text on this page is exactly what the console prints, including its British spellings. The tone column names the style the console gives the chip: ok (green), warning (amber), error (red), info, plain, quiet or muted.
## Incident status [#incident-status]
| Value | Chip | Tone | Meaning |
| -------- | ------------- | -------- | ----------------------------------------------------------------- |
| `open` | **Open** | Plain | Under investigation. Counts in the sidebar's **Incidents** badge. |
| `review` | **In review** | Info dot | Under review. Still counts as active. |
| `closed` | **Closed** | Quiet | The investigation is finished. |
The status menu in the incident header offers **Open**, **In review** and **Closed**. A change writes an **Activity** entry and a **Changed status** audit entry, and it leaves the report's state as it was.
The **Incidents** list filters by status: **Active** (the default, every incident that is not closed), **Open**, **In review**, **Closed** and **All**. On the site map, an open incident's pin is filled, an incident in review has an outlined pin and a closed one is faded. A vehicle card shows a warning chip with a count, such as **1 open** on UGV-02, while the vehicle has incidents that are not closed.
## Report state [#report-state]
| Value | Chip | Tone | Meaning |
| ----------- | ------------- | ----- | ------------------------------------------------------------------------------------------- |
| `draft` | **Draft** | Plain | The investigator is still writing the report. |
| `in_review` | **In review** | Info | Waiting for the incident's reviewer, who sees **Approve report** in **Review and history**. |
| `approved` | **Approved** | Ok | The reviewer approved the report. |
The **Report** tab shows the state beside its name. The **Before you export** checklist in **Review and history** marks each check ok or warning:
| Check | Ok | Warning |
| ------------------------------------------------- | ---------------------------------------------- | ----------------------------------------------------------------- |
| **Every sequence line cites its source (N of N)** | Every line cites a file | The sequence is empty, or a line has no file |
| **No order is claimed inside a clock bound.** | Always, with the count of pairs marked unknown | Never |
| Coordinates | **Coordinates are removed on export** | **Coordinates will be included on export** |
| Manual alignment | Not shown | **Uses a manual clock alignment, ±1.04 s** |
| Open questions | Not shown | **One question is still open**, or **N questions are still open** |
## Run status [#run-status]
| Value | Chip | Tone | Meaning |
| ------------- | --------------- | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `complete` | **Complete** | Ok dot | Parsed, with no source reported missing. |
| `partial` | **Partial** | Plain dot | A source is missing, such as "No companion journal for this run". Findings that depend on it are not produced, and reports list the gap under Limitations. |
| `parsing` | **Parsing** | Info, with a meter and a percentage | Foxborne is still working through the import job. |
| `quarantined` | **Quarantined** | Warning | A file could not be read in full. Nothing from it is shown as complete. |
| `rejected` | **Rejected** | Error | A file is not one Foxborne reads, such as an encrypted flight log. |
The **Runs** list filters by **All**, **Complete**, **Partial**, **Needs attention** and **Parsing**. **Needs attention** shows quarantined and rejected runs together, and their run pages offer **Replace the file**.
While a run parses, its page names the current step, in this order:
1. **Validating type, size and schema**
2. **Hashing originals**
3. **Parsing the flight log**
4. **Parsing journal and samples**
5. **Aligning clocks**
6. **Running rules**
When parsing ends, the run page's **Import job** drawer lists each step with an ok, warning or error mark and its time.
## Files on the Import page [#files-on-the-import-page]
| Chip | Tone | Meaning |
| --------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Validating** | Plain | Foxborne is checking the file's size and first bytes. The detail line reads **Detecting format** until the format is known. |
| **Hashing** | Info | Foxborne is computing the file's SHA-256, with a progress bar. |
| **Ready** | Ok | Detected and hashed. The detail line gives the format, the size and `sha256:` with the first 12 and last 4 hex characters. |
| **Quarantined** | Warning | **Named .ulg, but the ULog magic bytes are missing. The file may be corrupt or not a PX4 log.** |
| **New format** | Warning | A text log with times on every line that no parser covers yet, with a **Propose a parser** button. See [Import a format Foxborne does not read yet](/collect/import-files#import-a-format-foxborne-does-not-read-yet). |
| **Rejected** | Error | One of three reasons, below. |
A rejected file shows one of these reasons:
* **Larger than the 250 MB limit. Ask an admin to raise it for this import.**
* **Not a format Foxborne reads. Expected PX4 ULog, journalctl JSON, collector JSONL or receiver JSONL.**
* **The file could not be read.**
A ready file's detail line names the format and what Foxborne found in it:
| Format | Detail line |
| ---------------------- | ------------------------- |
| PX4 ULog, version N | **Magic bytes verified** |
| journalctl JSON export | **Journal fields found** |
| Receiver JSONL | **Receive records found** |
| Collector JSONL | **Process samples found** |
The hash line of a file you add from your computer ends with **computed in your browser**. Only ready files import when you select **Import**.
The footer of the **Run details** drawer reads **Add at least one file** until a file is ready, then counts the ready files, such as **3 files ready**. Once a file is ready, the **Files** panel header reads **Start time comes from the flight log**, or **No flight log, so the companion clock is used**.
## Clock chips [#clock-chips]
These chips appear in the **Clock** column of the **Incidents** and **Runs** lists, in a run's summary strip and in an incident's context strip.
| Chip | Tone | Meaning |
| --------------------- | ------- | ------------------------------------------------------------------------------------------ |
| **Aligned ±46 ms** | Ok | Every source is anchored. The figure is the widest bound between two sources. |
| **Manual ±1.09 s** | Info | The companion clock was aligned by hand. The figure includes the manual alignment's bound. |
| **Not aligned** | Warning | The companion clock has no anchor, so its events stay on their own clock. |
| **Elapsed time only** | Plain | The run has no anchor to UTC at all, such as an indoor run with no GPS fix. |
| **Pending** | Quiet | The run is still parsing. |
| **Not parsed** | Plain | Runs list only: the run was quarantined or rejected. |
The figures above are examples; each run shows its own.
## Bounds on files and events [#bounds-on-files-and-events]
| Text | Where | Meaning |
| -------------------------------- | --------------------------------------------------- | ------------------------------------------------------------------------------------- |
| **±40 ms** | Run page **Bound**, lane labels, evidence inspector | The source's error bound. |
| **±15 ms + latency** | Run page **Bound** | A receive log: the clock's bound plus one-sided link latency. |
| **No anchor** | Run page **Bound**, lane labels | Warning. The file has no error estimate and stays on its own clock. |
| **None** | Run page **Bound** and **Records** | The file did not parse. |
| **Own clock** | Evidence inspector and event page chips | Warning. The event is on an unaligned companion clock; its bound reads **no anchor**. |
| **Manual alignment** | Evidence inspector chip | Info. The event's time comes from a manual alignment. |
| **Companion clock, not aligned** | Event page, **Bound** | The event page's wording for an event on its own clock. |
## Ordering bounds between sources [#ordering-bounds-between-sources]
The run page and the incident's **Sources** tab show a matrix of every pair of files. Its subtitle reads "Two events closer than this cannot be put in order."
| Cell | Meaning |
| ------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| A minus sign | The diagonal: a file against itself. |
| **Same clock** | Both files share one clock, such as the companion journal and process samples. Their events are always ordered. |
| **±46 ms** | The combined bound of the two files. |
| **plus 412 ms latency** | A second line when a receive log is in the pair. Latency applies on the early side only. |
| A figure followed by **manual** | One side uses a manual clock alignment. Incident **Sources** tab only. |
| **No claim** | Warning. One file has no anchor, so Foxborne makes no before or after claim between the two. |
## Evidence levels [#evidence-levels]
| Level | Shape | Meaning |
| ------------------------------- | ----------------------- | -------------------------------------------------- |
| | Filled square | A value, event or log line captured directly. |
| | Two overlapping squares | Events that line up inside a known error bound. |
| | Dashed square | An explanation that still needs a check. |
| | Hatched square | Sources are missing, partial, or disagree on time. |
A report's sequence adds **Order unknown** to a pair of events whose intervals overlap, and the timeline hatches their overlap with the same label. The report's finding paragraph takes **Observed**, **Hypothesis** or **Unknown**.
## Event levels [#event-levels]
The event page gives each event a level chip.
| Chip | When |
| ------------ | ------------------------------------------------------------------------------ |
| **Critical** | Journal priority 2 or lower, or a failsafe event. |
| **Error** | Journal priority 3. |
| **Warning** | Journal priority 4, an event with a rule, or a link, stall or vibration event. |
| **Info** | Any other event. |
On the timeline, a journal event's tick is red at priority 3 or lower and amber at priority 4. **Events in view** marks journal events with a dot whose tooltip reads **Journal priority N**.
## Findings and report membership [#findings-and-report-membership]
| Text | Where | Meaning |
| ------------------------------------------------ | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| Rule ID and version, such as `telemetry_gap 1.3` | Inspector chip, **Events in view** | The rule and version that produced the finding. |
| **Dismissed** | Inspector chip | The finding was dismissed. Its flag leaves the **Findings** lane, and the inspector reads **Dismissed by** the name and reason. |
| **In the report** | Inspector footer | The event is already in the report sequence. |
| **In the report, step N** | Event page chip | The event's place in the sequence. |
| **No incident** | Event page, **Seen before** | That occurrence belongs to no incident. |
## Rule states [#rule-states]
| State | Control on **Rules** | Meaning |
| ------ | --------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| On | **Enabled** switch on | The rule runs on the next import. Every rule but `battery_sag` is on in the example dataset. |
| Off | **Enabled** switch off | The rule does not run. `battery_sag` is off by default. |
| Locked | Switch and **Edit** disabled; tooltip **Always on. Every ordering claim depends on it.** | Always on. `clock_uncertain` is the only locked rule. |
A switch change takes effect at once and names the rule in a toast that ends **Applies to the next import.** It does not change the rule's version.
## Source status [#source-status]
| Value | Chip | Tone | Meaning |
| ---------- | ------------------- | --------- | ----------------------------------------------------------------------------------------------------------- |
| `healthy` | **Healthy** | Green dot | Reading normally. |
| `degraded` | **Needs attention** | Amber | Working, with a problem the source drawer names in a note. |
| `paused` | **Paused** | Muted | An admin paused it. Foxborne reads no new files, files already imported stay, and **Sync now** is disabled. |
| `error` | **Error** | Red | Foxborne reports an error on the source. |
The sidebar's **Sources** item counts sources that need attention or are in error, in amber.
## Collector state [#collector-state]
| Chip on **Vehicle collectors** | Tone | Meaning |
| ------------------------------ | ------------- | ---------------------------------------------------------------------- |
| **Online** | Green dot | Connected and reporting. |
| **Buffering** | Amber | No uplink. The collector is spooling on the vehicle. |
| **Offline** | Muted | Not connected. A note under the chip gives the reason when one is set. |
| **Not enrolled** | Muted, no dot | No collector registered. The row offers **Enroll**. |
Vehicle cards and the vehicle page show the same state as **Reporting**, **Buffering offline**, **Offline** or **No collector**. The status bar counts collectors, such as **13 of 15 collectors reporting**. Its dot is green only when every enrolled collector is online, and amber otherwise.
## Collector clock, version and spool [#collector-clock-version-and-spool]
| Text | Column | Meaning |
| --------------------------------- | --------------- | -------------------------------------------------------------------------------------------------------------------- |
| **Synced +0.8 ms** | **Clock** | Green dot. The value is chrony's offset while it is synchronized. |
| **Not synchronised** | **Clock** | Amber. The companion's chrony has no reachable source, so the journal and samples stay on the companion's own clock. |
| **Unknown** | **Clock** | No clock report, such as on a vehicle that is not enrolled. |
| `0.8.1` | **Collector** | The current collector version. |
| **No SYSTEM\_TIME** | **Collector** | Shown beside an older version, such as `0.7.3`. The row offers **Update**. |
| **Not installed** | **Collector** | No collector on the vehicle. |
| **None**, or a bar with megabytes | **Local spool** | Nothing waiting on the vehicle, or the megabytes it holds. The bar turns amber above 60 MB. |
| **Never** | **Last upload** | No upload yet. |
| A count, in amber | **Dropped** | Samples discarded when the spool budget filled. The tooltip gives the collector's note. |
The summary strip above the table turns **Clock warnings** amber when any collector's clock is not synchronized. The enroll drawer reads **Waiting for** the host name **to connect** until the first upload arrives.
## Audit chain [#audit-chain]
| Text | Meaning |
| -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Chain intact** | The green note above the audit log: "N entries verified, the latest at HH:MM:SS UTC on D Mon. Entries also stream to your SIEM over syslog with TLS." |
| **Verifying** | **Verify chain** is running: "Recomputing each hash from the entry and the hash before it." |
| **Chain intact. Every entry matches.** | The toast when verification finishes. |
| `#18,247 852d7dc9` | The **Entry** column: the entry number and the first 8 hex characters of its hash. The tooltip gives both full hashes. |
| **System** | The **Person** column for entries Foxborne wrote itself. |
The audit log filters by **All**, **Evidence**, **Reports**, **Imports** and **Administration**.
## Marking levels [#marking-levels]
| Level | Banner text | Color |
| ----- | ---------------- | ---------------------------------- |
| `cui` | **CUI** | Purple, `#502b85`, with white text |
| `u` | **UNCLASSIFIED** | Green, `#007a33`, with white text |
The banner sits at the top of every screen and repeats as the first segment of the status bar, in the Astro UXDS classification colors. Turning it off in **Settings** toasts **Marking banner hidden**.
The export dialog shows the marking chip with its category, or **No CUI designation**. A classified deployment sets its banner from its own accreditation, not from **Settings**.
## Access and hosting chips [#access-and-hosting-chips]
| Text | Where | Meaning |
| --------------------------------------------- | ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Single sign-on** or **Local, hardware key** | **Access**, **Members**, **Sign-in** | How the person signs in. |
| **Break-glass** | **Access**, **Members** | The local account for when the identity provider is down. |
| **On** or **Pending first sign-in** | **Access**, **Members**, **Two-factor** | Whether two-factor sign-in is set up. |
| **Asserted** or **Not asserted** | **Access**, **Members**, **US person** | Whether the identity provider asserts US person status. |
| **Invited** | **Access**, **Members**, **Last active** | Invited, and not signed in yet. |
| **SCIM on** | **Access**, **Sign-in**, **Provisioning** | The identity provider provisions users through SCIM. |
| **Enforced** or **Off** | **Access**, **Sign-in**, **Export-controlled evidence** | Whether evidence marked EXPT opens only for US persons. |
| **Signature verified** | **Hosting**, **Version** | The installed release's signature was checked against the Foxborne release key. |
| **Healthy** | **Hosting**, **Nodes** | The node's state. |
| **None**, **Inbound** or **Internal** | **Hosting**, **Outbound connections** | The direction of each connection. **None** means nothing is sent. **Internal** also marks a destination turned on in **Integrations** that sits inside your network. |
| **Outbound** | **Hosting**, **Outbound connections** | Warning, with a dot. A destination turned on in **Integrations** that is reached outside your network. |
## Vehicle diagram tags [#vehicle-diagram-tags]
| Tag | Meaning |
| --------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| A source name, such as **Flight log** or **Journal, Process samples** | The part's sources are in the run. |
| **Via the flight log** or **Via the journal** | The part keeps no log of its own; its data travels in that source. |
| **Keeps no log** | The part keeps no log Foxborne can read. Its box has a dashed border. |
| A source name followed by **not imported** | The part's source is missing from the run. The tag is dimmed. |
| **State not observed** | Warning. The radio while its link to the companion computer is down. |
| **Nothing received** | Warning. The **Range control** tag while the evidence shows the ground receiving nothing. The dashed line from the radio turns amber with it. |
[Vehicle parts and their logs](/platforms/vehicle-parts) gives the tag of every part on both example platforms.
## Related [#related]
* [Import statuses and fixes](/collect/troubleshoot-imports) explains what to do about a quarantined or rejected file.
* [Evidence levels](/concepts/evidence-levels) explains the four levels in full.
* [Audit log](/security/audit-log) covers verification and export of the chain.
* [CUI marking](/security/cui-marking) covers the banner and the designation indicator.