fix: re-alert when withdrawn shows are re-listed

District published Endgame showtimes, the monitor alerted, and then the shows were
pulled. Dedupe remembered every session id it had announced, and re-listings often
reuse the same ids, so the moment bookings actually opened would have been silent.
It only re-armed this time because a redeploy happened to wipe the state file.

A session missing for three consecutive successful checks is now forgotten, so its
return alerts again. Three rather than one, so a flaky response can't produce a
duplicate max-priority push; failed checks don't count. When the whole date goes
dark after opening, a separate notice says the shows were withdrawn. The re-arm
lives in the base state rather than that notice's patch, so a lost notification
can't leave the monitor disarmed.

docs/design-notes.md

@@ -75,6 +75,14 @@ edge case testable without network or clock mocking, and it's where the interest
   alert's push succeeds. A failed notification retries on the next tick instead of being silently
   recorded as delivered.
 - **Dedupe by session id, not a boolean.** Shows added after the first alert still notify you.
+- **Dedupe does not outlive the listing.** Cinemas publish early, pull the shows and re-list
+  them, often under the same session ids, and this really happened with the Endgame release. A
+  show missing for three consecutive successful checks is forgotten, so its return alerts again.
+  Three rather than one, so a single flaky response can't cause a duplicate max-priority push,
+  and failed checks don't count, since an outage says nothing about whether a show exists. If
+  the whole date goes dark after opening, a separate notice says the shows were withdrawn. The
+  re-arm itself lives in the base state, not in that notice's patch, so it happens even if the
+  notice fails to deliver.
 - **`dateOpenAlerted` rides an alert patch, never the base state.** Otherwise a failed push
   followed by sessions disappearing could swallow the only notification you'd ever get.
 - **Open-but-empty counts as closed**, defending against a `200` with no sessions.