// Reproduces createdSignalsCount inflation when no-op chunks return currentResult.
    // We seed 2 matching events followed by 10 non-matching events and force 1 event/page.
    // The first two pages create 2 alerts; later no-op pages inflate the counter and can
    // trigger a false max-signals warning despite only 2 created preview alerts.
    it.only('reproduces false max alerts warning when later event pages have no threat matches', async () => {
      const id = `repro${Date.now()}`;
      const baseTs = moment();
      const timestamp = baseTs.toISOString();

      const matchingEvents = [
        {
          id,
          user: { name: 'matchuser' },
          '@timestamp': baseTs.clone().subtract(1, 's').toISOString(),
          'event.ingested': baseTs.clone().subtract(1, 's').toISOString(),
        },
        {
          id,
          user: { name: 'matchuser' },
          '@timestamp': baseTs.clone().subtract(2, 's').toISOString(),
          'event.ingested': baseTs.clone().subtract(2, 's').toISOString(),
        },
      ];
      const nonMatchingEvents = Array.from({ length: 10 }, (_, i) => ({
        id,
        user: { name: `eventmiss${i + 1}` },
        '@timestamp': baseTs
          .clone()
          .subtract(i + 3, 's')
          .toISOString(),
        'event.ingested': baseTs
          .clone()
          .subtract(i + 3, 's')
          .toISOString(),
      }));
      const threats = [
        {
          ...threatDoc(id, timestamp),
          user: { name: 'matchuser' },
        },
        ...Array.from({ length: 19 }, (_, i) => ({
          ...threatDoc(
            id,
            baseTs
              .clone()
              .subtract(i + 1, 'm')
              .toISOString()
          ),
          user: { name: `threatfiller${i + 1}` },
        })),
      ];

      await indexListOfDocuments([...matchingEvents, ...nonMatchingEvents, ...threats]);

      const rule: ThreatMatchRuleCreateProps = {
        ...threatMatchRuleEcsComplaint(id),
        threat_mapping: [
          {
            entries: [{ field: 'user.name', value: 'user.name', type: 'mapping' }],
          },
        ],
        items_per_search: 1,
        concurrent_searches: 1,
      };

      const { logs, previewId } = await previewRule({ supertest, rule });
      const previewAlerts = await getPreviewAlerts({ es, previewId, size: 1000 });
      console.log('previwaAlerts length ---- ');
      console.log(previewAlerts.length);
      const allWarnings = logs.flatMap((l) => l.warnings ?? []);

      // Exact created alert count can vary with fixture composition, but should remain small
      // while the max alerts warning is still emitted due to inflated createdSignalsCount.
      expect(previewAlerts.length).toBeGreaterThan(0);
      expect(previewAlerts.length).toBeLessThan(100);
      expect(allWarnings).not.toContain(getMaxAlertsWarning());
    });