Put the gate geometry next to the clock error and the failure stops being mysterious. Once a track converges, the innovation standard deviation settles around 36 m, so a five-sigma gate sits at roughly 180 m, and an airliner at 250 m/s covers that in 0.7 seconds [5]. That is the entire timing budget: about 0.72 seconds of wall clock, against a feed whose reported position age has a p90 of 3.97 s, some five and a half times the budget [4].
The worst case in the sampled pair of polls is not marginal. One aircraft's reported age fell by 15.76 s between two polls [8]. Stamped on arrival, that is 3,940 m of apparent displacement, about 109 sigma against a 36 m innovation standard deviation and roughly 22 times the gate radius [2]. Even the ordinary spread does it: the difference between the median age and the p90, 3.66 s, is 915 m of phantom movement, near 25 sigma [3]. The gate was doing its job with room to spare.
The mechanism worth internalising is that magnitude of lag is harmless and variation in lag is fatal. A uniform two-second delay is invisible to a constant-velocity filter, which simply tracks a target two seconds in the past with small innovations and no rejections [10]. What the gate cannot survive is the age changing between updates, which is what a fresh observation after a gap looks like when both the stale reading and the new one are marked "now" [12].
There is a second number in the sample that deserves a note. 17 of 135 contacts, 12.6%, were served identical positions across the two polls [9], which sits within 1.5 points of the 11.1% rejection rate [5]. The author does not connect the two, and on the mechanism above he is right not to: duplicates alone do not move a track. But a rejection log carrying the reported age and the observed time would settle it in an afternoon, and a counter never will.
Then the part that makes this architectural. The plausible repair is to stamp each measurement with arrival minus age and refuse anything older than the filter's current epoch, since you cannot predict backwards [13]. That guard would have made things worse, because the display loop advanced every track to current wall-clock time each cycle so the picture and the collision screen agreed, meaning the track's clock already read later than any measurement that arrived with real age [14]. A Kalman state is valid for exactly one instant, and once a render loop is allowed to move that instant, every measurement is applied to a state from a different moment than the one it describes [15]. Nobody reviews a rendering loop as an estimator mutation, which is how it survives review [15].
The pre-fix system was not inconsistent. Display and measurements shared the same fictional clock, so they agreed with each other, the tests passed and the picture looked right [16][2]. Correctness gates fail this way by design: they hold the invariant and say nothing about which invariant you gave them. A counter answers "how many" and closes the file. The two fields that separate a stale measurement from an implausible one were sitting in the record the whole time, decoded into the struct and never read again [6].
