A multi-window alert stops firing when it recovers

A long window detects a sustained problem and keeps firing for hours after it ends, which trains people to ignore the alert.

# long window alone: fires late, and clears an hour late
(1 - sli:availability_1h) > 0.0144

# with a short window ANDed: fires at the same time and
# clears within minutes
(1 - sli:availability_1h) > 0.0144
and
(1 - sli:availability_5m) > 0.0144

The long window is doing the detection and the short one is doing the recovery, which is the whole design and is not obvious from reading the expression. Without it an incident that lasted four minutes produces an alert that stays open for an hour, and the third time that happens somebody adds a silence rule.