Evidence, signaling & replay

In Advanced RF Analysis, choose Evidence beside a weak segment or PCI candidate. Expand Churn windows for individual overlapping windows. In Map & Events, choose Evidence beside an event or weak sample. Cici answers also provide app-owned evidence buttons.

The inspector shows the detection rule, selected samples/events and a 15-second before/after context. Blue points mark selected evidence; gray context is not part of the selected finding. RF and recorded throughput have separate units and charts. Use Show evidence map to inspect GPS context. Chart sampling is labeled; all window samples remain in the paginated table.

Choose Inspect row to see the original filename, physical text-line number or KML Placemark number, source-file SHA-256, original timestamp, resolved UTC instant and parser version. Column mapping and conversion notes explain how imported values became normalized measurements. Original rows stay in your browser.

New browser imports hash the exact uploaded bytes. Overlapping duplicates retain references to every contributing file. Legacy sessions and direct text-only imports show unavailable hashes rather than invented fingerprints. Keep the original files: the hash alone cannot establish their authenticity.

A timestamp without an offset is interpreted in the importing runtime timezone. That interpretation is recorded for replay, but it is not a verified device clock. Use ISO timestamps with an explicit offset, such as 2026-10-06T08:00:00+07:00, when aligning independently recorded logs.

RF measurements describe imported radio observations. Logged handover/reselection labels describe events in an app/export. Throughput describes recorded service measurements, including explicit zero and excluding missing values. Decoded RRC/NAS and service records are separate imports. VDT is prediction under frozen assumptions. Cici is an interpretation of a bounded summary, not a certified diagnosis.

A missing layer is explicitly unavailable. A serving-cell change is not proof of an RRC procedure, a failed handover or a NAS rejection. Sequential PCI mod-3 candidates do not prove simultaneous interference. Cici citation IDs are checked against app-generated references; this does not certify every sentence as correct.

Import your RF log first. In Map & Events, download Signaling template, replace the practice records with an authorized decoded export, then choose Import decoded signaling. The import is local enrichment of the session; it does not run another analysis or start a separate analysis. Binary TEMS/Nemo project files, modem captures and raw ASN.1/NAS bytes are not decoded by this importer. Use an authorized decoder/exporter to prepare the normalized JSON.

Use schema cakra.decoded-signaling, version 1. Each record requires a unique id, ISO timestamp with Z or an explicit offset, layer (RRC, NAS or SERVICE) and a decoded message name. Direction is UL, DL or UNKNOWN. Optional cellId must match the RF identifier exactly; PCI alone is not a unique cell ID. ueRef should be a local pseudonym, not IMSI or a phone number. outcome is an imported declaration, never inferred from a message name.

clockOffsetMs is added to signaling timestamps (positive moves them later); it must be documented and within ±24 hours. toleranceMs accepts 0–10,000 milliseconds and defaults to 500. A unique nearest time match plus exact cell is aligned, but the RF log still does not verify UE identity. Missing cell identity or tied matches are ambiguous. No matching sample is unmatched; an RF source without an explicit timezone is clock-unverified. The inspector displays offset, tolerance and signed time difference.

Review the separate RRC / NAS / Service table and choose Evidence to see temporal context and source records. These associations do not establish causality or procedure success. Keep device/receiver identity and clock synchronization evidence outside any AI interpretation; sanitize confidential fields before import or sharing.

Open Report / Print. Choose Full dataset or Active filters deliberately, then download Evidence bundle. It contains normalized RF samples/events, source references/hashes, filter snapshot, app/parser/rule versions and all imported decoded signaling records. Raw rows are excluded by default; enable Include raw rows only if authorized. Even without raw rows, the bundle contains coordinates, times, filenames, device and cell identifiers: share only with approved recipients.

In Map & Events, choose Open evidence bundle. The app checks its checksum, validates record references, requires a matching rule version and recomputes the finding register. Expand Replayed findings and select a finding to inspect its evidence. This is a read-only review: your active dataset, session and purchased balance do not change.

Audit JSON summarizes the report and finding IDs; CSV retains normalized measurements and source record references; GeoJSON preserves GPS observations. The technical PDF includes layer availability, file fingerprints and a compact finding register. Evidence bundle is the self-contained replay format. VDT frozen-run inputs/results remain in the separate optional VDT report attachment; replay never purchases or reruns predictions.

A checksum detects accidental modification, not authenticity or operator acceptance. A self-consistently re-created bundle can still contain invented input. Verify authorized original files, equipment, clocks and repeat drives before making an engineering decision. Keep exports before End session.