63,332 Impossible-Kinematics Dark Events Carry No Risk Tier. Their Anomaly Score Beats the Critical Tier's.

The Setup

In the 90 days ending September 24, Overwatch logged 93,825 impossible_kinematics dark events — position gaps where the reappearance point is kinematically inconsistent with the vessel's last known speed and heading. 63,332 of them, 67.5%, carry a risk_tier of null. That's more events than the four populated tiers combined: high (15,023), medium (8,663), low (3,466), and critical (3,341) add up to 30,493. The untiered bucket is the largest single group in the dataset by a factor of two.

The gap isn't cosmetic. The average kinematic_anomaly_score for untiered events is 0.646. The average for events explicitly tiered "critical" is 0.586. Untiered events also run the longest average gap duration of any bucket — 31.8 hours, versus 29.8 for critical and 21.1 for high. By the two continuous measures the pipeline already computes, the events with no tier at all look at least as anomalous as the ones flagged most severely.

The Chain

risk_score is also null for every one of the 63,332 untiered rows — this isn't a case of a numeric score existing without a label attached. Something upstream of tier assignment isn't running for this population. Splitting by detection_source shows why: 62,425 of the 63,332 untiered events, 98.6%, come through the worker path — Overwatch's real-time streaming detector. Only 907 come through batch. The worker path computes kinematic_anomaly_score inline as part of detection, but risk tiering appears to run as a separate step that the worker path isn't wired into. The earliest untiered event in the window dates to July 30; the most recent is from September 24, the day before this query — the gap has been open for at least eight weeks and is still accumulating in real time.

The Implication

Any downstream consumer that filters dark_events on risk_tier — a compliance queue, an alerting rule, a dashboard count — is silently dropping two-thirds of impossible-kinematics detections, including the subset with the highest average anomaly scores and the longest gap durations in the table. A team that believes it is monitoring "critical" and "high" impossible-kinematics events is monitoring roughly a third of them, and not the third that looks worst on the metrics Overwatch itself computes.

What to Watch

Whether risk-tier assignment gets extended to the worker detection path, or whether the 907 untiered batch events point to a second, smaller gap in that pipeline too. Whether the untiered population's anomaly-score and gap-duration averages hold as more events accumulate, or converge toward the tiered buckets once a larger sample is scored.

Limitations

90-day window ending September 24; a different window could shift the untiered share. This does not evaluate whether kinematic_anomaly_score itself is a reliable severity proxy — only that it and gap_duration_hours are the two fields available for comparison, and both favor the untiered population over "critical." Detection-source breakdown covers the untiered subset only; it does not establish that worker-sourced events are tiered at a lower rate than batch-sourced events overall, only that worker dominates the untiered count.

Data as of 2026-09-25. Source: Overwatch dark_events (subtype, risk_tier, risk_score, kinematic_anomaly_score, gap_duration_hours, detection_source), 90-day window on occurred_at.