Restore toc entries; comment out cross-refs to rules PR and missing images

Author: nastasha-solomon

explore-analyze/alerting/kibana-alerting-experimental/alerts.md

@@ -30,7 +30,10 @@ inactive → pending → active → recovering → inactive
 | Active | Problem confirmed and ongoing. This is when you get notified. |
 | Recovering | Errors have stopped, but the system is waiting to confirm it's truly resolved. |
 
+<!-- TODO: Uncomment when PR #6523 (rules) is merged:
 Activation and recovery thresholds control how many consecutive evaluations must agree, or how long the condition must persist, before transitioning. Refer to [Configure a rule](rules/configure-a-rule.md#activation-recovery-thresholds) to learn more about these settings.
+-->
+Activation and recovery thresholds control how many consecutive evaluations must agree, or how long the condition must persist, before transitioning.
 
 ### Example: First breach opens, first clear closes
 
@@ -43,9 +46,11 @@ A checkout-latency rule runs in Alert mode every 5 minutes. Latency breaches at
 
 One problem is tracked in one episode, even though the rule evaluated many times while the condition was ongoing.
 
+<!-- TODO: Add image once alert-episode-example-without-threshold.png is available in explore-analyze/images/
 :::{image} ../../images/alert-episode-example-without-threshold.png
 :alt: Timeline of a checkout-latency alert episode without thresholds. At 14:05, p95 jumps to 3.1s and the episode opens immediately as active. It stays active through 14:45. At 14:50, p95 drops back under 2s and the episode resolves immediately as inactive.
 :::
+-->
 
 ### Example: Waiting for confirmation before opening and closing
 
@@ -60,9 +65,11 @@ The same checkout-latency rule, now with an activation threshold of 2 consecutiv
 
 Thresholds prevent brief spikes from opening episodes and transient dips from closing them prematurely. The episode waits in `pending` until the problem is confirmed, and waits in `recovering` until the resolution is confirmed.
 
+<!-- TODO: Add image once alert-episode-example-with-activation-threshold.png is available in explore-analyze/images/
 :::{image} ../../images/alert-episode-example-with-activation-threshold.png
 :alt: Timeline of a checkout-latency alert episode with activation threshold of 2 and recovery threshold of 2. At 14:05, the first breach puts the episode in pending. At 14:10, the second consecutive breach moves it to active. At 14:50, the first clean check moves it to recovering. At 14:55, the second consecutive clear resolves it to inactive.
 :::
+-->
 
 ## Series
 
@@ -72,7 +79,9 @@ Your rule monitors services. Each service it tracks has its own series, one for
 
 Think of it like a patient's medical file. The file exists as long as the patient is in the system. Individual health incidents come and go, but the file persists.
 
+<!-- TODO: Uncomment when PR #6523 (rules) is merged:
 For the fields that identify a series in alert event documents, refer to [Rule event and field reference](rules/rule-event-field-reference.md#rule-reference).
+-->
 
 ### How series and episodes relate
 

explore-analyze/alerting/kibana-alerting-experimental/alerts/alert-states-and-fields-reference.md

@@ -11,7 +11,10 @@ description: "Reference for episode status, `.rule-events` row status, and `.ale
 # Alert states and fields reference [alert-states-reference]
 
 
-Alert states and fields are part of the experimental alerting features in Kibana. Use these tables when you read alert UI state, query `.rule-events` or `.alert-actions` in Discover, or align API payloads with what operators see. For triage controls (acknowledge, snooze, resolve, tags) and how they map to storage, refer to [Alert actions](view-and-manage-alerts.md#alert-actions). For rule evaluation fields on `.rule-events`, refer to [Rule event and field reference](../rules/rule-event-field-reference.md#rule-reference).
+Alert states and fields are part of the experimental alerting features in Kibana. Use these tables when you read alert UI state, query `.rule-events` or `.alert-actions` in Discover, or align API payloads with what operators see. For triage controls (acknowledge, snooze, resolve, tags) and how they map to storage, refer to [Alert actions](view-and-manage-alerts.md#alert-actions).
+<!-- TODO: Uncomment when PR #6523 (rules) is merged:
+For rule evaluation fields on `.rule-events`, refer to [Rule event and field reference](../rules/rule-event-field-reference.md#rule-reference).
+-->
 
 ## Episode status
 

explore-analyze/alerting/kibana-alerting-experimental/alerts/query-alerts-and-signals-in-discover.md

@@ -22,5 +22,8 @@ To use this page, open Discover, select {{esql}}, paste a query from the example
 <!--[CONTENT NEEDED for M2: Review and expand the query examples below once M2 field renames (`group_hash` → `series.key`, new `series.tracked_by`, `episode.severity`, `episode.severity_max`) are finalized. Add examples that take advantage of the new first-class severity and series fields.]
 -->
 
+For field names, types, and episode fields, refer to [Alert states and fields reference](alert-states-and-fields-reference.md#alert-states-reference). For triage in the product UI, refer to [View, manage, and reference alerts](view-and-manage-alerts.md).
+<!-- TODO: Uncomment when PR #6523 (rules) is merged and restore full sentence:
 For field names, types, and episode fields, refer to [Alert states and fields reference](alert-states-and-fields-reference.md#alert-states-reference) and [Rule event and field reference](../rules/rule-event-field-reference.md#rule-reference). For triage in the product UI, refer to [View, manage, and reference alerts](view-and-manage-alerts.md).
+-->
 

explore-analyze/toc.yml

@@ -380,6 +380,11 @@ toc:
           - file: report-and-share/reporting-troubleshooting-pdf.md
   - file: alerting.md
     children:
+      - file: alerting/kibana-alerting-experimental/alerts.md
+        children:
+          - file: alerting/kibana-alerting-experimental/alerts/view-and-manage-alerts.md
+          - file: alerting/kibana-alerting-experimental/alerts/alert-states-and-fields-reference.md
+          - file: alerting/kibana-alerting-experimental/alerts/query-alerts-and-signals-in-discover.md
       - file: alerting/alerts.md
         children:
           - file: alerting/alerts/alerting-getting-started.md