180,310 Solo Dark Events in 90 Days. The Multi-Vessel Coordination Layer Found 7 Clusters. None Were Critical.

The Setup

In 90 days, dark_events logged 180,310 AIS gap events — vessels that went silent and reappeared without explanation. Of those, 3,006 reached the critical risk tier, with an average gap duration of 28.9 hours.

In the same period, the multi-vessel coordination detector produced 7 event clusters. Fifteen linked events total. All at low or medium risk.

Zero of the 3,006 critical events have a multi_vessel_event_id.

The Chain

The coordination layer groups dark events sharing spatial and temporal proximity into clusters flagged via multi_vessel_event_id. The design intent: vessels going dark together, near the same location, in the same window represent a different threat model than isolated gaps. The data structure supports it. The output is 7 clusters.

Of those 7: three are at approximately 25.6°N, 55.1°E — the approaches to the Strait of Hormuz, UAE offshore. They appeared within a 36-hour window on May 20. Average gaps in that cluster group run 109 to 222 hours. One is a three-vessel event; two are pairs. None exceeded medium risk tier.

The remaining four clusters are distributed across the Gulf of Mexico coast (two separate events), the Singapore Strait, and the Kattegat. All are pairs. All are low or medium.

The critical stack — 3,006 events with 28.9-hour average gaps — has no coordination linkage anywhere in it.

The Implication

Two separate problems surface in this data.

The first is structural: the coordination detector output doesn't overlap with the high-risk stack. It finds pairs and a triple in known high-opacity zones. Those are plausible clusters. But the critical-tier solo events — the events with the longest gaps and highest risk scores — aren't being linked to anything. If coordinated AIS evasion generates critical-tier events, the coordination layer isn't connecting them.

The second is calibration: kinematic_anomaly_score saturates at the same p95 value (0.900) across all risk tiers. Critical events average 0.578 on that score; medium events average 0.613. The critical tier is running lower on kinematic anomaly than medium events, not higher. The score that should reflect physically impossible vessel movement during a gap isn't stratifying in the direction risk tier would imply. The two signals — risk tier and kinematic anomaly — are essentially independent.

The 345 kinematic violations in the solo stack (0.19% of 180,310 events) represent cases where vessel reappearance was physically inconsistent with the gap duration. None of those are in clusters either.

What to Watch

A coordination detection rate of 7 clusters per 90 days against 180,310 solo events (0.0039%) warrants threshold review. Either coordinated multi-vessel evasion is genuinely rare, or the proximity thresholds are tight enough to miss most of it. The Hormuz cluster — three vessels in a 36-hour window with gaps averaging over 120 hours — is the strongest signal in the output. Five more pairs across four geographic zones in 90 days is a thin result for a global stack.

The kinematic anomaly score distribution suggests a floor-and-ceiling issue rather than a useful discriminator across the queue.

Limitations

The coordination clustering parameters are not exposed in this layer. What reads as a dormant detector may reflect strict spatial thresholds rather than absent activity. The kinematic anomaly score ceiling at p95 = 0.900 may be a deliberate normalization cap. Both require internal configuration context to confirm.

Dark events: 90-day window. Multi-vessel clusters: 7. Solo events: 180,310. Critical-tier solo events: 3,006. Kinematic violations: 345.