Alert on 1 failure or 3? I simulated a month of checks to see the trade-off

Requiring several consecutive failures before alerting kills false alarms and adds delay. A runnable simulation shows how steep that trade-off is, and where the assumptions break.