[rules-users] Sliding length window of (1) equals latest event?!