This is the option I go with. It may be nothing more than the rush of displaced air as the invisible rogue attacks with their dagger, but a character with Alertness is able to sense it in the nick of time and have a chance to react.
I disagree with the idea that ALL attacks a preceded by clues which are automatically perceived, even by creatures that failed their Perception checks. It's against the rules (in that successful checks mean you gain the information, while FAILED checks
should mean you FAIL to get that information) and contrary to the established narrative.
Let me take it step-by-step. First, there is more than one way to be 'not surprised'; I'll just talk about the two ways that we have been discussing:-
1.) 'notice a threat' (by way of the DM saying you notice it automatically, or a successful ability check contest)
2.) 'immunity to surprise' (by way of the Alert feat, Weapon of Warning, various other abilities)
In the same way that 'poodles are dogs' AND 'rotweilers are dogs' does NOT mean that 'poodles are rotweilers', you can be 'not surprised' because you 'noticed a threat', you can be 'not surprised' by being 'immune to surprise', but this does NOT mean that being 'immune to surprise' makes you 'notice a threat'!
Being immune to surprise means that you are 'not surprised'
even though you did NOT notice a threat!
If you are a trained assassin, spending all your resources on being almost undetectable before you strike, and you make all your skill rolls, use
silence/invisibility and so on, and the victims all fail to match your Stealth with their Perception, but they happen to have faster reflexes than you, the fact that they are immune to surprise should not result in the DM ignoring the facts that the rolls have established re: you being hidden! The DM should not give information that should be gated behind
successful Perception checks, nor should he narrate your arrow 'hitting or missing' (which is what breaks hiding, not 'attacking')
before you resolve your attack.
Sure, the victims have a
chance to detect the attack
before it is resolved (hear the bow creak as it is bent back, or whatever), but we already rolled for that and established that the victims FAILED to notice these clues. Therefore, the DM should not give these clues anyway!
The alert guy in this situation has NO direct information about the (successfully hidden) assassin!
The alert guy DOES know that combat is starting, and can make educated guesses to help him make smart decisions.
Immunity to surprise is very useful, but it is not an automatic 'I win' button; it does not make you 'notice a threat'; it makes you 'not surprised' even if you FAIL to 'notice a threat'.