Per ingest: trigger_count += 1 when fired; consecutive += 1 or reset to 0; avg_score = running mean of risk scores on triggers. Key: (merchant, employee, rule, 7d).