Read the pictures, the aircraft, the meters and the sensors

Hexadecimal is a true answer to "what did that say" and not a useful one.
This is the work of turning the rest of what a receiver hears into
something a person can read, and most of it is pictures.

PICTURES

Three of the things on the air are images rather than sounds, and all three
arrive as the audio a scan already records:

  SSTV     14.230 and 144.5 MHz   Martin M1/M2, Scottie S1/S2/DX, Robot 36/72
  APT      137-138 MHz            the NOAA weather satellites
  HF fax   2-20 MHz, sideband     the marine weather charts

Each is written from its published specification, and the generators used to
test them are written from the same specification without reference to the
decoders -- so a picture that comes back matching the one that went in is
evidence about the format.  Every SSTV mode reproduces its published line
time exactly, which is worth failing a test over: a line a few milliseconds
long walks the picture off the screen inside ten lines.  Against synthetic
transmissions at 30 dB SNR, SSTV is 96-98% of pixels exact, APT correlates
at 0.97 and fax at 0.998; all three still read at 6-12 dB.

None of the three is guessed at, and that is what makes it safe to try them
on every recording.  SSTV needs its VIS header, APT needs both line syncs at
the right distance from each other, fax needs the phasing signal.  No false
pictures in 295 attempts over noise, tones, speech and swept whistles.

Two things had to be got right beyond the arithmetic.  A band-pass does not
switch between two tones, it slides between them, so every edge is measured
at the midpoint of the slide rather than at the first sample past a
threshold -- the earlier version was reading the coarse search stride back
as the edge and shifting Martin M1 sideways by a whole colour bar.  And a
picture now keeps its capture whatever the content check made of it: a
satellite is a steady tone with a wobble on it and SSTV is a whistle, so
both were being discarded as "no signal content" having already been
recognised.

PNG is written here rather than pulled in from Pillow.  A scanner that
cannot start because an imaging library is missing is worse than one that
cannot draw.

saunterbrowse marks a picture in the list, gives its path in full -- wrapped
rather than cut off, because half a path opens nothing -- and moves or
deletes the PNGs with the recording.  o prints the picture's path, not the
audio's.

GRIB is not a modulation and is not pretended to be one.  It is the format
weather models are published in and it travels by satellite link and by
e-mail; where a decoded byte stream begins with its magic number it is
named, and that is all.

AIRCRAFT

`bandsaunter adsb` parks the receiver on 1090 MHz and reads Mode S extended
squitter: address, callsign, altitude, position, speed.  A command of its
own because a megabit a second will not go through a channel twelve and a
half kilohertz wide.  Every frame carries a 24-bit checksum so there is no
threshold anywhere in it -- with one trap, which is that a frame of all
zeros satisfies that checksum and silence is exactly that.  Positions round
trip exactly through compact position reporting, and a pair straddling a
longitude-zone boundary is refused rather than resolved against two grids.

METERS AND SENSORS

Itron ERT utility meters on 900 MHz and AcuRite weather sensors on 433 MHz
are named rather than reported as hex, and neither is believed without its
own checksum -- BCH(255,239) for the meter, a checksum and four parity bits
for the sensor.  Both are implemented from published descriptions and
checked against frames built from the same descriptions, which proves the
framing and the arithmetic and is not the same as having held a meter.

HEX INTO WORDS

Everything else that decodes to bits now gets its fields named where the
shape is standard, its text read out where there is text, and its bytes laid
out in groups with the printable characters beside them.

The text search is where the care went, because printability is not
evidence.  Forty framings of each packet, and seven-bit values printable
three in four, meant a bar set on printability called 64% of random payloads
text.  Real text is nearly all one case where random letters are half and
half, two fifths vowels where random is a fifth, and mostly alphanumeric
where random draws punctuation one time in four.  Together: under 0.5%,
measured in the suite.

CALLSIGNS

The licensed address is recorded in full -- the street, not merely the town
-- and goes into the KML with everything else.  US amateur records are
public by law and carry it; holding it and not saying so is worse than
either showing it or not asking, and --no-lookup asks for none of it.

Also here: Morse is decoded again from the whole recording where the capture
was made in cw mode.  The first pass works from the classifier's buffer,
which holds a few seconds -- enough to say "this is Morse", not enough to
catch a callsign whole between two word gaps, so a beacon repeating every
eight seconds through an eight-second window was never identified.

And classify._psk_order took the logarithm of zero on a silent block.

1318 tests, up from 1161.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016PsWPTweCT6pwxKngvVxcg

README.md

@@ -819,6 +819,154 @@ text is still shown; it is the *identification* that is held to the stricter
 standard. Over 1805 truncated captures of four different messages, that turns
 107 invented callsigns into none, while still recovering 550 correct ones.
 
+## Pictures
+
+Three of the things a receiver can hear are images rather than sounds. All
+three are analogue, all three encode brightness as a frequency, and all three
+arrive as the audio the scanner already records — so they are looked for in
+every recording and written out as PNG beside it.
+
+| | Where | What it is |
+|---|---|---|
+| **SSTV** | 14.230 MHz, 144.5 MHz | amateur slow-scan television, in colour — Martin M1/M2, Scottie S1/S2/DX, Robot 36/72 |
+| **APT** | 137–138 MHz | the NOAA weather satellites, one continuous picture per fifteen-minute pass |
+| **HF fax** | 2–20 MHz, single sideband | the marine weather charts, 60–240 lines a minute |
+
+```
+147.06 MHz  118.0s  SNR 24.1 dB  SSTV (Martin M1)
+            picture: SSTV Martin M1 320x256 → ~/bandsaunter/0014.230000MHz--2026-08-29_14_02_11-usb.png
+```
+
+**None of the three is guessed at**, which is what makes it safe to try them
+on every recording. SSTV announces itself with a VIS header that says which
+mode follows. APT carries two different sync patterns exactly 1040 words
+apart. Fax opens with twenty seconds of phasing — black lines with a pulse at
+the start of each — that nothing else on the air sends. A decoder without one
+of those draws static beautifully, and a directory of beautifully rendered
+static is worse than an empty one. Measured over noise, tones, speech and
+frequency-swept whistles: **no false pictures in 295 attempts**.
+
+Accuracy, against transmissions built from the published specifications:
+
+| | 30 dB SNR | 12 dB | 6 dB |
+|---|---|---|---|
+| SSTV (all seven modes) | 96–98% of pixels exact | 91–98% | — (header lost below 9 dB) |
+| APT | 0.97 correlation | 0.94 | 0.88 |
+| HF fax | 0.998 correlation | 0.99 | 0.97 |
+
+Each mode's line timing is checked against its published line time — 446.446 ms
+for Martin M1, 428.220 for Scottie S1, and so on — because a line a few
+milliseconds long walks the picture off the bottom of the screen within ten
+lines, and that is a thing worth failing a test over rather than noticing in a
+PNG.
+
+**A picture keeps its capture whatever the content check made of it.** A
+satellite is a steady tone with a wobble on it and an SSTV transmission is a
+whistle: neither is speech, neither has symbol structure, and both were being
+discarded as "no signal content" *having already been recognised*.
+
+Pictures take minutes rather than seconds, so `--record` has to be long enough
+or what arrives is the top of one. A partial picture is kept and labelled
+partial rather than thrown away — most SSTV captures are partial, and half a
+picture is still a picture.
+
+> **GRIB** is sometimes asked about in the same breath and is not a modulation:
+> it is the binary format weather models are published in, and it travels by
+> satellite data link and by e-mail rather than as something a receiver
+> demodulates. Where a decoded byte stream begins with its magic number it is
+> named; nothing here fetches or renders one.
+
+## Aircraft
+
+```bash
+bandsaunter adsb                  # listen on 1090 MHz until interrupted
+bandsaunter adsb --frames         # print every frame as it arrives
+bandsaunter adsb --kml planes.kml # and write what was heard as a map
+```
+
+Every airliner overhead broadcasts its address, callsign, altitude, position
+and speed twice a second, unencrypted, to nobody in particular.
+
+```
+ICAO    callsign  altitude  position           speed        frames
+4CA1FA  RYR1234   35000 ft  51.5000, -0.1200   308 kt 126°  47
+A0B1C2  UAL99     12000 ft  40.7000, -74.0000  180 kt 274°  31
+```
+
+A command of its own because **ADS-B does not fit through the scanner**: the
+signalling is a megabit a second, which needs at least two megasamples a second
+of raw receiver output, and the scan path decimates everything to a channel
+12.5 kHz wide long before a decoder sees it.
+
+Every frame carries a 24-bit checksum, so there is no threshold and nothing to
+disbelieve — a frame passes or it is dropped. The one trap is that a frame of
+all zeros satisfies that checksum, and silence between transmissions is exactly
+that, so silence would otherwise decode as an endless stream of aircraft
+`000000`.
+
+A position takes **two** frames. The encoding sends a fraction of a zone rather
+than a coordinate, so one frame alone is ambiguous by hundreds of miles; an
+aircraft is placed once an even and an odd frame have both arrived, about a
+second apart. A pair that straddles a longitude-zone boundary is refused rather
+than resolved against two different grids.
+
+An aerial cut for 1090 MHz is the difference between hearing the airport and
+hearing the county; the whip supplied with a dongle is a quarter of the length
+it wants.
+
+## Meters and weather sensors
+
+Two things on the ISM bands are worth naming rather than reporting as hex.
+
+```
+915.0 MHz   decoded: electricity meter 12345678  reading 987654
+433.92 MHz  decoded: AcuRite sensor 1234  temperature 21.5 C  humidity 48%  channel A
+```
+
+**Utility meters.** The Itron ERT modules fitted to electricity, gas and water
+meters across North America broadcast their reading every thirty seconds or so
+on 902–928 MHz, in the clear, so a van can drive past and read a street. The
+message says which meter, what kind, what the register reads, and whether the
+tamper switches have been tripped.
+
+**AcuRite sensors.** The 433.92 MHz outdoor sensors sold with every consumer
+weather station send temperature, humidity, battery state and a channel letter
+every sixteen seconds.
+
+Neither is guessed at: a meter message carries a 16-bit BCH check and a sensor
+message a checksum and four parity bits, and nothing is reported that has not
+satisfied them. Both are implemented from their published descriptions and
+checked against frames built from the same descriptions — which proves the
+framing and the arithmetic, and is not the same as having held a meter.
+
+## Hex into words
+
+Everything else that decodes to bits gets read rather than dumped:
+
+```
+EV1527 / PT2262:  address 0x8B2F1  button B
+text (8-bit ASCII): "STATION OPEN"
+0000  53 54 41 54 49 4F 4E 20  |STATION |
+0008  4F 50 45 4E 0D 0A 00 91  |OPEN....|
+```
+
+A decoder that stops at a bit string has done half the job, and `4A 3F 1B 22`
+is a true answer to "what did the doorbell say" and not a useful one. Where the
+packet is a shape somebody standardised its fields are named; where there is
+text in it the text is read out; and underneath either, always, the bytes in
+groups with their printable characters beside them.
+
+The text search is the part that needs care, and **printability is not
+evidence**. Every framing is tried at every bit offset in both bit orders —
+about forty readings of each packet — and seven-bit values are printable three
+times in four, so a bar set on printability alone called **64% of random
+payloads text**. What separates a message from a coincidence is that real text
+is nearly all one case where random letters are half and half, is about two
+fifths vowels where random letters over 52 are a fifth, and is mostly letters
+and digits where random draws punctuation one time in four. Together with a
+length bar those take random payloads to **under 0.5%**, which is measured in
+the test suite and fails there if it stops being true.
+
 ### Single sideband
 
 SSB needs no `--mode usb`. Nothing else does either, but SSB is the mode where
@@ -1192,6 +1340,7 @@ or symbol rate where there is one, and the bands the frequency falls in.
 | `s` | sort by time, frequency or length |
 | `r` | re-read the directory, picking up what a running scan has written |
 | `o` | print the file's path and quit |
+| — | a picture is marked in the list, with the path of its PNG |
 | `S` `I` `N` | file it into `saved/`, `investigate/` or `noise/` |
 | `u` | put the last one filed back |
 | `d` | delete it and its sidecars, for good — asks first |