61,158 AIS Dark-Manipulation Alerts in 90 Days Touch 20,690 Vessels. The Adjudication Field Has Never Been Set — Not Once, Across All 134,967 Motif Alerts.

The Setup

AIS_manipulation_dark alerts have filed 61,158 times in the trailing 90 days, touching 20,690 distinct vessels — the highest-volume of Overwatch's five active behavioral motifs this quarter. Average confidence on those alerts sits at 0.85, well below the flat 1.00 that spoofing and ship-to-ship-transfer alerts carry, which on its own suggests the detector is doing genuine discriminating work rather than flagging everything at ceiling. None of it has been touched. Not this motif, not any of the other four running alongside it. Across the full history of the motif_alerts table — 134,967 rows stretching back to early April — the adjudication_status field has never once held a non-null value.

The Chain

The motif went live April 6 and has run continuously since, producing 62,777 alerts in its lifetime — meaning 61,158 of those, 97%, landed in just the trailing quarter. Either the detector was recently tuned to fire harder, or the underlying behavior it tracks is accelerating; the table doesn't distinguish the two. What it does show clearly is the review side. The schema carries dedupe_key, suppression_until, and analyst_updated_by columns — the scaffolding for a working adjudication loop, the same one documented for suppressing false positives and deduplicating repeat alerts. That scaffolding has never been used. A direct count across every row in motif_alerts, every motif class, every day since the table existed, returns zero non-null adjudication_status values. This isn't a backlog of alerts sitting in a "pending" state waiting on an analyst — that would mean the field was set and simply not advanced. This is a field that has never been written to at all.

The Implication

Whatever downstream process is supposed to consume "reviewed" versus "unreviewed" alerts — a compliance dashboard, a sanctions-screening handoff, an analyst work queue — has been reading a column that has only ever contained one value across its entire existence. A confidence score averaging 0.85 rather than a flat 1.00 means there's real variance under these 61,158 dark-manipulation alerts, real separation between the vessels most likely to be genuinely masking position and the ones that tripped a softer threshold. That separation has never been used to triage a single case. Whether 20,690 vessels represents a handful of serial offenders or a broad base of one-off anomalies is exactly the question adjudication would answer, and exactly the question the null field leaves open.

What to Watch

Whether the 90-day volume (61,158) keeps growing relative to the lifetime total (62,777) — i.e., whether this motif is still ramping toward a new baseline or has already reached one — over the next full reporting cycle.

Limitations

This can't distinguish whether adjudication_status is unused because no review workflow has shipped yet, or because review happens through a separate process that writes elsewhere. Confirming which requires checking the consuming application, not another query against motif_alerts. The 0.85 average confidence is also a single aggregate; it doesn't rule out a bimodal split between a large low-confidence cluster and a smaller high-confidence one, which would change how urgent the missing review layer actually is.

Data as of 2026-08-28. Source: Overwatch motif_alerts, motif_name='AIS_manipulation_dark', trailing 90 days (61,158 alerts, 20,690 distinct vessels, avg confidence 0.849); adjudication_status null-check across full table history (134,967 rows, first alert 2026-04-06).