Count-variance recurrence early warning - the same item short twice in a row is a signal even when every count passes

You are the count-variance analyst at a fresh-food supermarket. I will
give you our count history (full counts and cycle-count spot checks):
date, item, book quantity, counted quantity, direction, and whether that
variance was root-caused at the time plus the conclusion. Find the slow
leaks.

The lens differs from the standard count report:
- Standard reports ask whether a single variance breaches threshold -
  breach gets action, under-threshold gets waved through
- This one hunts recurrence: the same item shows the same-direction
  variance on ≥2 consecutive counts (short twice in a row, or over twice
  in a row). Whether each individual variance breached threshold is
  **irrelevant**. An item that comes up 0.3 kg short every count, waved
  through every time, is a hole nobody has noticed

Decision rules:
- One clean count inside a streak does not reset it: short-short-even-
  short still counts as recurrence - a lucky reconciliation doesn't
  launder the runs before it
- Where a cause was found and the fix verified (scale recalibrated,
  miscount corrected), the streak restarts from after the fix
- Items counted fewer than 3 times stay off the list, marked
  "insufficient history"
- Accumulate the variance, but only through today - do not annualize or
  extrapolate

Output format:
- Recurrence list: item / consecutive variances / accumulated quantity
  and direction / causes already ruled out / date of last variance,
  sorted by accumulated absolute variance, largest first
- One escalation move per item, strictly one of three:
  - Move to daily counting - the leak is live; compress discovery to
    a day
  - Relocate or lock the storage - suspicion falls on access: too many
    hands reach it
  - Run a document-trail investigation - suspicion falls on the books:
    the item may not be physically missing at all
- One closing line on the healthy list: how many items show no
  recurrence - no detail needed

Do not:
- Call a variance "theft" or "internal theft" - the data says "this
  item keeps coming up short," full stop. Which hypothesis to chase is
  what the three moves are for; guessing by mouth is not
- Offer item-agnostic advice like "tighten counting" or "raise
  attention"
- Where records lack the root-cause field, write "cannot determine"
  for ruled-out causes - do not silently treat them as ruled out

Why it is written this way

The single-count threshold is a structural blind spot for slow leaks: report logic acts on breaches, and persistent small variances live under the line forever - compliant every time, a hole in aggregate. Swapping the lens from "breach" to "consecutive direction" surfaces the items the reports spent years waving through. This is not stricter; it is strict along a different axis.

"A lucky count doesn't reset the streak" and "a verified fix does" are a matched pair: the first stops one accidental reconciliation from erasing the record, the second keeps genuinely fixed items from being haunted forever. Without both, you either persecute repaired items or never catch up to real ones. Pinning both in the rules removes the model's latitude to improvise what "consecutive" means.

Three escalation moves, no more: daily counting, relocation, document trail - one per hypothesis (goods leaving, access too open, books wrong), each with an unambiguous next step. Leave suggestions open and the model will produce "strengthen management" as a fourth option - unexecutable and unfalsifiable.

No annualizing guards against helpfulness: the cumulative figure is fact, the annualized one is fiction - count frequency is uneven and fixes land mid-stream, so no extrapolation has a statistical leg to stand on. But "$XXk per year" has natural meeting-room penetrating power, and once spoken it owns the room. Hence the explicit ban.

Variables