Just looking at your rules, I believe it is a problem in understanding how sliding windows work in Drools.
In Drools, sliding windows are used to filter events based on timestamp, but they do not prevent the detection of an event. I.e., although your event might have arrived late (for whatever reason, including network latency), it still happened, and since you are using no other filters, your rule means you wanted to detect that event. So, an activation is created for that rule, even if the event will be expired right after the activation is created.
Please note that this is not the only semantics possible for Sliding Windows found in the literature, but was the one that best matched our requirements and was therefore adopted for the Drools implementation.
I want to add more semantics and make them configurable in the future, but it is not there yet.
Edson
--
Edson Tirelli
JBoss Drools Core Development
JBoss by Red Hat @ www.jboss.com