Two burn rates: one pages, one raises a ticket

A single burn-rate alert either pages for a slow leak or misses a fast one, and two thresholds cover both without either being wrong.

# fast: 14.4x burn over 1h — a 30-day budget gone in 2 days
- alert: BudgetBurningFast
  expr: |
    (1 - sli:checkout:availability_1h) > 14.4 * 0.001
    and (1 - sli:checkout:availability_5m) > 14.4 * 0.001
  labels: { severity: page }

# slow: 3x burn over 6h — noticeable, not urgent
- alert: BudgetBurningSlowly
  expr: |
    (1 - sli:checkout:availability_6h) > 3 * 0.001
    and (1 - sli:checkout:availability_30m) > 3 * 0.001
  labels: { severity: ticket }

The multipliers come from the published site reliability material and are worth using as given rather than derived, because the arithmetic connecting them to a budget window is easy to get subtly wrong. The short second window in each is what makes the alert stop firing promptly once the condition clears.