func (s *clusterDataStoreTestSuite) TestProcessMatching() {
	ctx := context.Background()

	helmClusterID := fixtureconsts.Cluster1
	manualClusterID := fixtureconsts.Cluster2

	// Helm-managed cluster with non-nil RuntimeDataControl; Regex should match "test-.*" namespaces.
	helmCluster := &storage.Cluster{
		Id:        helmClusterID,
		Name:      "helm-cluster",
		ManagedBy: storage.ManagerType_MANAGER_TYPE_HELM_CHART,
		HelmConfig: &storage.CompleteClusterConfig{
			DynamicConfig: &storage.DynamicClusterConfig{
				RuntimeDataControl: &storage.DynamicClusterConfig_RuntimeDataControl{
					NamespaceFilter: "test-.*",
					Persistence:     true,
				},
			},
		},
	}

	// Helm-managed cluster with nil DynamicConfig/RuntimeDataControl; should take the default path
	// and return "not matched" without error.
	nilRuntimeControlCluster := &storage.Cluster{
		Id:        uuid.NewV4().String(),
		Name:      "no-runtime-control",
		ManagedBy: storage.ManagerType_MANAGER_TYPE_HELM_CHART,
		HelmConfig: &storage.CompleteClusterConfig{
			// DynamicConfig intentionally nil.
		},
	}

	// MANUAL-managed cluster to exercise non-Helm cache path and namespace filter source.
	// For these tests we rely on the default behavior (no RuntimeDataControl) and verify that
	// we still get a deterministic non-error result.
	manualCluster := &storage.Cluster{
		Id:        manualClusterID,
		Name:      "manual-cluster",
		ManagedBy: storage.ManagerType_MANAGER_TYPE_MANUAL,
		// No HelmConfig – this should force the datastore down the MANUAL-management path.
	}

	// Upsert clusters so MatchProcessIndicator can look them up.
	require.NoError(s.T(), s.datastore.UpsertCluster(ctx, helmCluster))
	require.NoError(s.T(), s.datastore.UpsertCluster(ctx, nilRuntimeControlCluster))
	require.NoError(s.T(), s.datastore.UpsertCluster(ctx, manualCluster))

	// Process indicators to exercise regex matching and default behavior.
	matchingIndicator := &storage.ProcessIndicator{
		ClusterId: helmClusterID,
		Namespace: "test-namespace",
		PodId:     "pod-1",
		Signal: &storage.ProcessSignal{
			ContainerId: "container-1",
			Name:        "nginx",
		},
	}

	nonMatchingIndicator := &storage.ProcessIndicator{
		ClusterId: helmClusterID,
		Namespace: "prod-namespace",
		PodId:     "pod-2",
		Signal: &storage.ProcessSignal{
			ContainerId: "container-2",
			Name:        "nginx",
		},
	}

	nilRuntimeControlIndicator := &storage.ProcessIndicator{
		ClusterId: nilRuntimeControlCluster.Id,
		Namespace: "any-namespace",
		PodId:     "pod-3",
		Signal: &storage.ProcessSignal{
			ContainerId: "container-3",
			Name:        "redis",
		},
	}

	manualClusterIndicator := &storage.ProcessIndicator{
		ClusterId: manualClusterID,
		Namespace: "manual-namespace",
		PodId:     "pod-4",
		Signal: &storage.ProcessSignal{
			ContainerId: "container-4",
			Name:        "busybox",
		},
	}

	s.Run("helm cluster with matching namespace filter", func() {
		matched, err := s.datastore.MatchProcessIndicator(ctx, matchingIndicator)
		require.NoError(s.T(), err)
		assert.True(s.T(), matched, "expected helm cluster regex to match namespace")
	})

	s.Run("helm cluster with non-matching namespace filter", func() {
		matched, err := s.datastore.MatchProcessIndicator(ctx, nonMatchingIndicator)
		require.NoError(s.T(), err)
		assert.False(s.T(), matched, "expected helm cluster regex NOT to match namespace")
	})

	s.Run("helm cluster with nil RuntimeDataControl", func() {
		matched, err := s.datastore.MatchProcessIndicator(ctx, nilRuntimeControlIndicator)
		require.NoError(s.T(), err, "expected default behavior without error when RuntimeDataControl is nil")
		assert.False(s.T(), matched, "expected default behavior to return not-matched when RuntimeDataControl is nil")
	})

	s.Run("manual-managed cluster", func() {
		// First call exercises initial cache population / lookup path.
		matched1, err := s.datastore.MatchProcessIndicator(ctx, manualClusterIndicator)
		require.NoError(s.T(), err)
		// We don't assert a specific match policy here, only that the behavior is consistent and non-erroring.
		// For the current implementation we expect "false" when no RuntimeDataControl is present.
		assert.False(s.T(), matched1, "expected manual-managed cluster to return not-matched by default")

		// Second call should hit any internal cache path, and must behave identically.
		matched2, err := s.datastore.MatchProcessIndicator(ctx, manualClusterIndicator)
		require.NoError(s.T(), err)
		assert.Equal(s.T(), matched1, matched2, "manual-managed cluster matching should be stable across cache hits")
	})

		} else {
			log.Debugf("Process indicator filtered out (cluster=%s, namespace=%s, deployment=%s, execPath=%s)",
				indicator.GetClusterId(),
				indicator.GetNamespace(),
				indicator.GetDeploymentId(),
				indicator.GetSignal().GetExecFilePath())
		}

func (suite *ManagerTestSuite) TestFlushIndicators() {
	deploymentID1, indicator1 := makeIndicator()
	deploymentID2, indicator2 := makeIndicator()

	// Queue both indicators.
	suite.manager.queuedIndicators[deploymentID1] = indicator1
	suite.manager.queuedIndicators[deploymentID2] = indicator2

	// Make first indicator to match and be filtered out.
	suite.cluster.EXPECT().MatchProcessIndicator(gomock.Any(), indicator1).
		Return(true, nil)

	// The second indicator should pass through.
	suite.cluster.EXPECT().MatchProcessIndicator(gomock.Any(), indicator2).
		Return(false, nil)

	// Only the second indicator should be persisted.
	suite.indicators.EXPECT().
		AddProcessIndicators(gomock.Any(), []*storage.ProcessIndicator{indicator2}).
		Return(nil)

	suite.manager.flushIndicatorQueue(context.Background())
}

func (suite *ManagerTestSuite) TestFlushIndicators_MatchError() {
	deploymentID, indicator := makeIndicator()

	// Queue the indicator.
	suite.manager.queuedIndicators[deploymentID] = indicator

	// Simulate a matching error for this indicator.
	suite.cluster.EXPECT().
		MatchProcessIndicator(gomock.Any(), indicator).
		Return(false, errors.New("match error"))

	// On error, the indicator should still be persisted so it isn't lost.
	suite.indicators.EXPECT().
		AddProcessIndicators(gomock.Any(), []*storage.ProcessIndicator{indicator}).
		Return(nil)

	suite.manager.flushIndicatorQueue(context.Background())
}

func (suite *ManagerTestSuite) TestFlushIndicators_EmptyQueue() {
	// Start with an empty queue to exercise the edge case.
	suite.manager.queuedIndicators = make(map[string]*storage.ProcessIndicator)

	// No indicators should be written when the queue is empty.
	suite.indicators.EXPECT().
		AddProcessIndicators(gomock.Any(), gomock.Any()).
		Times(0)

	// Should not panic and should not attempt to persist indicators.
	suite.manager.flushIndicatorQueue(context.Background())
}