cctally 1.7.2 → 1.7.3

package/CHANGELOG.md

@@ -5,6 +5,23 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.7.3] - 2026-05-16
+
+### Added
+- `cctally record-usage`: detect in-place 5h credits on a `>=5.0pp` drop within the same canonical `five_hour_window_key` while `prior_5h_resets_at > now_utc`; write a `five_hour_reset_events` row with the credit moment floored to a 10-minute slot on `effective_reset_at_utc` (supports stacked credits across DISTINCT 10-min slots up to ~30 per 5h block; same-slot collisions silently absorbed by `INSERT OR IGNORE` per spec §2.3 documented cap — an intentional bound, not a bug); force-write `hwm-5h` via the credit-only escape hatch since the normal monotonic-up write at `bin/_cctally_record.py:1722-1731` would refuse to decrease it; then DELETE stale-replica snapshots scoped to `(five_hour_window_key = ?, captured_at_utc >= effective_iso, round(five_hour_percent, 1) = round(prior_5h_pct, 1))` so `claude-statusline`'s in-memory replay of pre-credit `--percent` values across the credit moment cannot poison the post-credit clamp segment. Mirrors the v1.7.2 weekly credit-detection path parallel-not-identical; threshold is 5pp (not 25) because intra-block percents are smaller, and `effective_reset_at_utc` floor is 10 minutes (not the hour) so distinct intra-hour stacked credits stay reachable.
+- schema: new `five_hour_reset_events` table with columns `(detected_at_utc, five_hour_window_key, prior_percent, post_percent, effective_reset_at_utc)` and `UNIQUE(five_hour_window_key, effective_reset_at_utc)`. Payload diverges from the weekly precedent (`prior_percent` + `post_percent` instead of boundary keys) because the 5h variant has a stable canonical window key and only the percent moves — storing both lets renderers show `−Δpp` without re-querying snapshots and supports the rare stacked-credit chain across distinct 10-minute slots. Created adjacent to `week_reset_events` in `_apply_schema` (both are parallel concepts at different cadences); no FK on `five_hour_window_key` per the CLAUDE.md documentation-only-FK gotcha; no `_backfill_five_hour_reset_events` call (forward-only ship per spec Q5; historical backfill deferred).
+- migration `006_five_hour_milestones_reset_event_id`: adds `reset_event_id INTEGER NOT NULL DEFAULT 0` to `five_hour_milestones` and reshapes UNIQUE from `(five_hour_window_key, percent_threshold)` to `(five_hour_window_key, percent_threshold, reset_event_id)` so post-credit threshold crossings re-fire as distinct rows instead of being silently absorbed by `INSERT OR IGNORE` against the pre-credit row at the same threshold. SQLite can't ALTER a UNIQUE constraint in place — the handler uses the rename-recreate-copy idiom inside its own `BEGIN/COMMIT`. Live DDL at `bin/cctally:3902` is updated in lockstep with the migration handler so the dispatcher's fresh-install fast-stamp path lands the correct shape without invoking the handler; the `PRAGMA table_info` probe stamps the marker without redoing the rename when the column is already present (covers fresh-install + partial-failure-retry cases). Mirrors weekly migration 005's pattern. Sentinel `0` = pre-credit / no-event; existing rows backfill to 0 via the column DEFAULT.
+
+### Changed
+- 5h DB clamp at `bin/_cctally_record.py:1521-1527` becomes reset-aware via JOIN on `five_hour_reset_events` keyed on the canonical `five_hour_window_key`; the `COALESCE`-to-epoch-zero default keeps legacy clamp behavior byte-identical on DBs without any event rows, while a credited window's `MAX(five_hour_percent)` over the post-credit segment correctly excludes pre-credit snapshots so a fresh post-credit OAuth value (e.g. 4%) lands instead of being held back by stale pre-credit history (e.g. 28%). `unixepoch()` wraps both sides of the captured-vs-effective comparison so the `Z`-vs-`+00:00` offset mix in stored values doesn't break the bound under lex compare — same rule as the production weekly clamp from v1.7.2.
+- renderers: `cctally five-hour-blocks` shows an inline `⚡ credited −Xpp @ HH:MM` chip beside the block-start cell on credited block rows (multiple credits in one block concatenate as `⚡ −Xpp, −Ypp` across distinct 10-min slots); text + JSON envelope (new `credits[]` field per block) + share-output (`--format md` / `html` / `svg`) all carry the annotation via `_build_five_hour_blocks_snapshot`'s `__credits` side-channel piggy-backed on the existing `block_start` cell formatting. `cctally five-hour-breakdown` interleaves a `⚡ CREDIT −Xpp @ HH:MM` divider row between pre-credit and post-credit milestones (merged stream ordered by `captured_at_utc`); JSON gains `credits[]` parallel to `milestones[]` and each milestone now carries `resetEventId` (sentinel 0 = pre-credit, positive integer = post-credit segment id). Dashboard 5h panel chip + `CurrentWeekModal.tsx` 5h milestones section (new envelope key `current_week.five_hour_milestones` parallel to weekly's `current_week.milestones`) + dashboard alerts list row-identity widening (alert id becomes `five_hour:{window_key}:{threshold}:{reset_event_id}` mirroring the weekly precedent at `bin/_cctally_dashboard.py:2597` — NOT a filter, both segments stay in the list as distinct rows) + TUI 5h tile `[⚡ −Xpp]` badge.
+- migration `003_merge_5h_block_duplicates_v1`: defensive update to the milestone dedup loop — widens the dedup key from `percent_threshold` alone to `(percent_threshold, reset_event_id)` via a `PRAGMA table_info` probe so an operator-triggered re-run after migration 006 (`cctally db unskip 003_merge_5h_block_duplicates_v1`, fresh-DB-from-corrupted-backup, future tooling) doesn't silently collapse legitimately distinct pre/post-credit milestone rows at the same threshold inside one physical block. Byte-identical on the legacy upgrade path where the column doesn't yet exist (003 runs before 006 in migration order; `has_seg=False` collapses the key tuple to `(threshold, 0)`).
+- `cctally record-usage`: credit pivots (HWM force-write + stale-replica DELETE) now run UNCONDITIONALLY when a credit is detected on either axis — gating them on `INSERT OR IGNORE`'s `rowcount` (5h branch) or on the `already is None` pre-check (weekly branch) wedged the system permanently on pre-credit HWM + stale-replica rows if a prior invocation committed the event row but crashed before the pivots could run (memory `project_dedup_must_not_gate_side_effects.md`: "Skipping a no-op INSERT must NOT skip milestones/rollups/alerts; prior run may have died mid-flight"). The event-row INSERT stays gated against duplicates; pivots are individually idempotent so re-running them on the recovery tick is safe. Regressions: `tests/test_in_place_5h_credit_detection.py::test_pivots_run_when_event_row_already_committed` + `tests/test_in_place_credit_detection.py::test_weekly_pivots_run_when_event_row_already_committed`.
+- `cctally record-usage`: round-4 follow-up — 5h credit-detection dedup pre-check refined from a single-field `post_percent` compare to a pair-check against BOTH `prior_percent` AND `post_percent` of the most-recent stored event row, AND the post-detection pivots (HWM force-write + stale-replica DELETE) hoisted OUT of the `if not is_dup:` block so they fire on every detection entry. The round-3 single-field predicate false-positived on a legitimate second credit when the user was idle between credits (Credit 1 lands prior=20/post=5; Credit 2 arrives with new CLI percent=0 while prior_5h_pct still reads 5 from the post-Credit-1 snapshot — `5 == 5` matched the stored `post_percent` so the second credit was silently swallowed, no event row written, no HWM force-write, no DELETE). Pair-check disambiguates: a genuine replay matches BOTH fields; a new credit-with-idle matches at most ONE. Hoisting the pivots is the second half of the same fix — a recovery tick where the pair-check legitimately dedupes (event row already durable from a crashed prior invocation, snapshot rolled back so prior_5h_pct still reads the pre-credit value, pair `(20,5)` matches stored `(20,5)`) still needs to force HWM down and DELETE stale replicas; pre-fix those pivots sat INSIDE `if not is_dup:` and got skipped on every recovery tick, leaving the system wedged on the pre-credit HWM forever. Both pivots are individually idempotent (file overwrite, DELETE on stable predicate) so re-running on a replay or recovery tick is always safe. Codex r4 P1 finding ([PR #46 comment 3252721643](https://github.com/omrikais/cctally-dev/pull/46#discussion_r3252721643), issue [#43](https://github.com/omrikais/cctally-dev/issues/43)). Regressions: `tests/test_in_place_5h_credit_detection.py::test_consecutive_credits_with_idle_between` (proves pair-check lets Credit 2 land) + `tests/test_in_place_5h_credit_detection.py::test_replay_with_pair_match_still_runs_pivots` (proves pivots fire when pair-check dedupes).
+- `cctally record-usage`: 5h self-heal probe at `bin/_cctally_record.py:1958+` becomes segment-aware via `_resolve_active_five_hour_reset_event_id`, mirroring the weekly Probe 1 precedent at `bin/_cctally_record.py:1880-1908`. Without segment scoping a credited block's `MAX(percent_threshold)` over the whole ledger reads the pre-credit ceiling (e.g. 28%) and silently suppresses the post-credit ledger's heal even when it has zero rows; with scoping, post-credit threshold crossings inside a stale-`last_observed_at_utc` slot finally trigger heal. Regression: `tests/test_in_place_5h_credit_detection.py::test_5h_self_heal_probe_scoped_to_active_segment`.
+- dashboard alerts envelope: weekly alerts `context` block now exposes `reset_event_id` parallel to the 5h shape — pre-Round-3 the weekly path widened the row identity (`id` includes `:{reset_event_id}`) but did NOT include the segment in `context`, while the 5h path did. Round-3 adds `context.reset_event_id` to weekly so both axes mirror the same shape and downstream consumers (panel, modal, third-party) can discriminate pre- vs post-credit crossings of the same (week, threshold) without scraping the opaque `id` string. Regression: `tests/test_5h_milestone_segment_threading.py::test_weekly_alerts_context_exposes_reset_event_id`.
+- React component coverage: new credit-chip tests in `dashboard/web/__tests__/CurrentWeekPanel.test.tsx` (single + stacked deltas, `data-credit-count` analytics attr, in-row placement) + new 5h-milestone-section tests in `CurrentWeekModal.test.tsx` (section visibility gate, count pill, `⚡ CREDIT` divider row with `colspan=5`, React row key disambiguation by `reset_event_id` so post-credit threshold repeats render as distinct rows). Server-side envelope coverage extended in `tests/test_five_hour_block_envelope.py` (new `_seed_credit_event` helper + populated `credits[]` + empty-array contract + ascending-order chain across stacked credits). Share-output goldens: new `tests/fixtures/share/five-hour-blocks-credit-{md,html,svg}/` fixtures (one in-place credit seeded in `stats.db` via `bin/build-share-fixtures.py`) assert the `⚡ -20pp` chip carries uniformly through all three share-render formats. Dashboard CSS: new `.credit-chip` + `.mcw-5h-credit-row` + `.mcw-5h-credit-cell` + `.m-sec.sec-5h` rules in `dashboard/web/src/index.css` so the credit annotations match the rest of the panel/modal's accent-amber treatment.
+
 ## [1.7.2] - 2026-05-16
 
 ### Fixed

package/bin/_cctally_dashboard.py

@@ -2490,7 +2490,7 @@ def _select_current_block_for_envelope(
 
     block = conn.execute(
         """
-        SELECT block_start_at, last_observed_at_utc,
+        SELECT five_hour_window_key, block_start_at, last_observed_at_utc,
                seven_day_pct_at_block_start,
                crossed_seven_day_reset
           FROM five_hour_blocks
@@ -2539,11 +2539,41 @@ def _select_current_block_for_envelope(
         None if (p_anchor is None or current_used_pct is None)
         else round(current_used_pct - p_anchor, 9)
     )
+
+    # Spec §5.3 — in-place credit events for this 5h block's window,
+    # ascending by ``effective_reset_at_utc``. Drives the
+    # ``CurrentWeekPanel.tsx`` ``⚡ credited -Xpp`` chip and the
+    # ``CurrentWeekModal.tsx`` merged-stream 5h milestones section.
+    # Snake_case keys to match the envelope convention (see CLAUDE.md;
+    # CLI ``--json`` uses camelCase, dashboard envelope is snake_case).
+    cred_rows = conn.execute(
+        """
+        SELECT effective_reset_at_utc, prior_percent, post_percent
+          FROM five_hour_reset_events
+         WHERE five_hour_window_key = ?
+         ORDER BY effective_reset_at_utc ASC
+        """,
+        (int(block["five_hour_window_key"]),),
+    ).fetchall()
+    credits = [
+        {
+            "effective_reset_at_utc": c["effective_reset_at_utc"],
+            "prior_percent": float(c["prior_percent"]),
+            "post_percent": float(c["post_percent"]),
+            "delta_pp": round(
+                float(c["post_percent"]) - float(c["prior_percent"]), 1
+            ),
+        }
+        for c in cred_rows
+    ]
+
     return {
         "block_start_at":               block["block_start_at"],
+        "five_hour_window_key":         int(block["five_hour_window_key"]),
         "seven_day_pct_at_block_start": p_start,
         "seven_day_pct_delta_pp":       delta,
         "crossed_seven_day_reset":      crossed,
+        "credits":                      credits,
     }
 
 
@@ -2603,13 +2633,29 @@ def _build_alerts_envelope_array(
                 "week_start_date":     r["week_start_date"],
                 "cumulative_cost_usd": cumulative,
                 "dollars_per_percent": dpp,
+                # Round-3: parallel to the 5h context block below — both
+                # axes now expose ``reset_event_id`` so downstream
+                # clients (panel, modal, third-party consumers) can
+                # discriminate pre- vs post-credit crossings of the
+                # same (week, threshold) without scraping the
+                # envelope ``id`` string. 0 = pre-credit / no-event;
+                # event.id = post-credit segment.
+                "reset_event_id":      int(r["reset_event_id"]),
             },
         })
 
+    # Site F (spec §3.2 bucket C / §3.3): widen the row identity to
+    # include ``reset_event_id`` so post-credit (seg=event.id) crossings
+    # of the same (window_key, threshold) don't collide with pre-credit
+    # (seg=0) crossings on the React row key. Older clients tolerate
+    # longer ids — the id is opaque to them; only the React key
+    # uniqueness invariant matters. Mirrors the weekly precedent at
+    # line ~2597.
     fh_rows = conn.execute(
         """
         SELECT m.five_hour_window_key, m.percent_threshold, m.captured_at_utc,
-               m.alerted_at, m.block_cost_usd, b.block_start_at
+               m.alerted_at, m.block_cost_usd, m.reset_event_id,
+               b.block_start_at
         FROM five_hour_milestones m
         LEFT JOIN five_hour_blocks b ON b.five_hour_window_key = m.five_hour_window_key
         WHERE m.alerted_at IS NOT NULL
@@ -2621,7 +2667,10 @@ def _build_alerts_envelope_array(
     for r in fh_rows:
         threshold = int(r["percent_threshold"])
         out.append({
-            "id":          f"five_hour:{int(r['five_hour_window_key'])}:{threshold}",
+            "id":          (
+                f"five_hour:{int(r['five_hour_window_key'])}:"
+                f"{threshold}:{int(r['reset_event_id'])}"
+            ),
             "axis":        "five_hour",
             "threshold":   threshold,
             "crossed_at":  r["captured_at_utc"],
@@ -2630,6 +2679,7 @@ def _build_alerts_envelope_array(
                 "five_hour_window_key": int(r["five_hour_window_key"]),
                 "block_start_at":       r["block_start_at"] or "",
                 "block_cost_usd":       float(r["block_cost_usd"] or 0.0),
+                "reset_event_id":       int(r["reset_event_id"]),
             },
         })
 
@@ -3065,6 +3115,17 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
                     }
                     for m in (snap.percent_milestones or [])
                 ],
+                # Spec §5.3 (Codex r1 finding 3) — NEW envelope key
+                # parallel to ``milestones`` (which carries the WEEKLY
+                # timeline). 5h-block milestones for the active block,
+                # in capture-time order, both pre- and post-credit
+                # segments included (bucket B per §3.2 — no
+                # ``reset_event_id`` filter; the React layer renders
+                # repeated thresholds as distinct rows keyed on
+                # ``reset_event_id``). Empty list when no 5h block is
+                # bound or the data source crashed during sync
+                # (recorded on ``last_sync_error``).
+                "five_hour_milestones":     getattr(snap, "five_hour_milestones", []) or [],
             },
 
         "forecast":

package/bin/_cctally_db.py

@@ -1009,36 +1009,65 @@ def _migration_merge_5h_block_duplicates_v1(conn: sqlite3.Connection) -> None:
 
             # (c) Milestones: per-threshold dedup, keep earliest
             # captured_at_utc, re-FK keepers to canonical.
+            #
+            # Defensive widening (Codex r2 finding 1, spec §3.4): if
+            # migration 006 has already landed and added ``reset_event_id``,
+            # key the dedup on ``(percent_threshold, reset_event_id)`` so
+            # we don't silently collapse legitimately distinct pre/post-
+            # credit rows at the same physical threshold. On the legacy
+            # upgrade path (column doesn't exist yet because 003 runs
+            # before 006 in migration order), ``has_seg`` is False and the
+            # dedup key collapses to ``(threshold, 0)`` — byte-identical
+            # to the original threshold-only shape. PRAGMA probe rather
+            # than version-detect so the path also covers operator
+            # re-runs (e.g. ``cctally db unskip 003_*``) post-006.
+            ms_cols = {
+                str(r[1])
+                for r in conn.execute(
+                    "PRAGMA table_info(five_hour_milestones)"
+                ).fetchall()
+            }
+            has_seg = "reset_event_id" in ms_cols
             ms_id_placeholders = ",".join(
                 "?" * (len(dropped_ids) + 1)
             )
-            all_milestones = conn.execute(
-                f"SELECT id, percent_threshold, captured_at_utc "
-                f"  FROM five_hour_milestones "
-                f" WHERE block_id IN ({ms_id_placeholders})",
-                [canonical["id"], *dropped_ids],
-            ).fetchall()
-            by_threshold: dict[int, dict] = {}
+            if has_seg:
+                all_milestones = conn.execute(
+                    f"SELECT id, percent_threshold, captured_at_utc, "
+                    f"       reset_event_id "
+                    f"  FROM five_hour_milestones "
+                    f" WHERE block_id IN ({ms_id_placeholders})",
+                    [canonical["id"], *dropped_ids],
+                ).fetchall()
+            else:
+                all_milestones = conn.execute(
+                    f"SELECT id, percent_threshold, captured_at_utc "
+                    f"  FROM five_hour_milestones "
+                    f" WHERE block_id IN ({ms_id_placeholders})",
+                    [canonical["id"], *dropped_ids],
+                ).fetchall()
+            by_key: dict[tuple[int, int], dict] = {}
             for m in all_milestones:
-                t = m["percent_threshold"]
+                seg = int(m["reset_event_id"]) if has_seg else 0
+                key = (int(m["percent_threshold"]), seg)
                 md = dict(m)
                 if (
-                    t not in by_threshold
+                    key not in by_key
                     or md["captured_at_utc"]
-                    < by_threshold[t]["captured_at_utc"]
+                    < by_key[key]["captured_at_utc"]
                 ):
-                    by_threshold[t] = md
-            keep_ids = {m["id"] for m in by_threshold.values()}
+                    by_key[key] = md
+            keep_ids = {m["id"] for m in by_key.values()}
             # DELETE non-keepers BEFORE rekeying keepers. Otherwise, when
             # both canonical and a dropped block hold a milestone for the
-            # same percent_threshold and the dropped row's milestone is
-            # the earlier keeper, UPDATEing it to the canonical key
-            # collides with canonical's still-present non-keeper on
-            # UNIQUE(five_hour_window_key, percent_threshold), rolling
-            # back the migration. After this DELETE the only milestones
-            # referencing dropped_keys are the keepers themselves
-            # (one per threshold), so the UPDATE loop below is collision-
-            # free.
+            # same physical key and the dropped row's milestone is the
+            # earlier keeper, UPDATEing it to the canonical key collides
+            # with canonical's still-present non-keeper on UNIQUE
+            # (either the 2-col legacy shape or the 3-col post-006 shape),
+            # rolling back the migration. After this DELETE the only
+            # milestones referencing dropped_keys are the keepers
+            # themselves (one per dedup key), so the UPDATE loop below is
+            # collision-free.
             non_keep_ids = [
                 m["id"] for m in all_milestones if m["id"] not in keep_ids
             ]
@@ -1049,7 +1078,7 @@ def _migration_merge_5h_block_duplicates_v1(conn: sqlite3.Connection) -> None:
                     f" WHERE id IN ({nk_placeholders})",
                     non_keep_ids,
                 )
-            for m in by_threshold.values():
+            for m in by_key.values():
                 conn.execute(
                     "UPDATE five_hour_milestones "
                     "   SET block_id = ?, "
@@ -1437,6 +1466,138 @@ def _migration_percent_milestones_reset_event_id(conn: sqlite3.Connection) -> No
         raise
 
 
+@stats_migration("006_five_hour_milestones_reset_event_id")
+def _migration_five_hour_milestones_reset_event_id(conn: sqlite3.Connection) -> None:
+    """Add ``reset_event_id`` to ``five_hour_milestones`` so post-credit
+    threshold crossings can coexist with pre-credit ones for the same
+    ``(five_hour_window_key, percent_threshold)``.
+
+    Sentinel: ``0`` = pre-credit / no event. Existing rows backfill to
+    ``0`` via the ``DEFAULT 0`` clause on the new column.
+
+    The new UNIQUE constraint is
+    ``UNIQUE(five_hour_window_key, percent_threshold, reset_event_id)`` so
+    the same (window_key, threshold) pair can land twice if a goodwill
+    credit re-opens the segment under a fresh ``five_hour_reset_events.id``.
+    SQLite can't ALTER a UNIQUE constraint in place — we use the
+    rename-recreate-copy idiom (same as migration 005 did for
+    ``percent_milestones``).
+
+    Companion live-path edits land at (Task 2 of issue #43):
+      - bin/_cctally_record.py — 5h milestone INSERT + alert paths
+        (Sites A-E in spec §3.3); grep ``active_reset_event_id`` to
+        locate (line numbers drift per ``gotcha_cited_line_numbers_stale``)
+      - bin/_cctally_dashboard.py — alerts list row-identity widening
+        (Site F in spec §3.3 — bucket C per spec §3.2's three-bucket model);
+        grep ``reset_event_id`` near the 5h alerts SELECT
+
+    Idempotent: a second invocation finds the column already present and
+    returns. Empty-table fast path: when the column is already present
+    (fresh-install fast-stamp from the dispatcher because the live
+    ``CREATE TABLE IF NOT EXISTS five_hour_milestones`` already carries
+    the new shape — REQUIRED for fresh-install correctness per spec §3.2),
+    the marker still gets stamped — no schema edit needed.
+    """
+    # Fast-path probe: column already present means a prior run of this
+    # migration (or a fresh-install fast-stamp from the dispatcher that
+    # already picked up the new live-schema CREATE TABLE) has done the
+    # work. Just stamp the marker and return. The marker INSERT runs in
+    # SQLite's implicit transaction (auto-opened by the write, closed by
+    # ``commit()`` — same shape as migration 005's fast path); no explicit
+    # ``BEGIN`` is needed for a single-statement DML.
+    cols = {
+        str(r[1])
+        for r in conn.execute("PRAGMA table_info(five_hour_milestones)").fetchall()
+    }
+    if "reset_event_id" in cols:
+        conn.execute(
+            "INSERT OR IGNORE INTO schema_migrations (name, applied_at_utc) "
+            "VALUES (?, ?)",
+            ("006_five_hour_milestones_reset_event_id", now_utc_iso()),
+        )
+        conn.commit()
+        return
+
+    conn.execute("BEGIN")
+    try:
+        # Add the column with sentinel 0 default (covers existing rows).
+        conn.execute(
+            "ALTER TABLE five_hour_milestones "
+            "ADD COLUMN reset_event_id INTEGER NOT NULL DEFAULT 0"
+        )
+        # SQLite can't ALTER a UNIQUE constraint in place; rename, recreate
+        # with the new 3-column UNIQUE, copy, drop. Preserves ids and every
+        # existing column (including those added by add_column_if_missing:
+        # alerted_at).
+        conn.execute(
+            "ALTER TABLE five_hour_milestones "
+            "RENAME TO five_hour_milestones_old_006"
+        )
+        conn.execute(
+            """
+            CREATE TABLE five_hour_milestones (
+                id                          INTEGER PRIMARY KEY AUTOINCREMENT,
+                block_id                    INTEGER NOT NULL,
+                five_hour_window_key        INTEGER NOT NULL,
+                percent_threshold           INTEGER NOT NULL,
+                captured_at_utc             TEXT    NOT NULL,
+                usage_snapshot_id           INTEGER NOT NULL,
+                block_input_tokens          INTEGER NOT NULL DEFAULT 0,
+                block_output_tokens         INTEGER NOT NULL DEFAULT 0,
+                block_cache_create_tokens   INTEGER NOT NULL DEFAULT 0,
+                block_cache_read_tokens     INTEGER NOT NULL DEFAULT 0,
+                block_cost_usd              REAL    NOT NULL DEFAULT 0,
+                marginal_cost_usd           REAL,
+                seven_day_pct_at_crossing   REAL,
+                alerted_at                  TEXT,
+                reset_event_id              INTEGER NOT NULL DEFAULT 0,
+                UNIQUE(five_hour_window_key, percent_threshold, reset_event_id),
+                FOREIGN KEY (block_id) REFERENCES five_hour_blocks(id)
+            )
+            """
+        )
+        conn.execute(
+            """
+            INSERT INTO five_hour_milestones (
+                id, block_id, five_hour_window_key, percent_threshold,
+                captured_at_utc, usage_snapshot_id,
+                block_input_tokens, block_output_tokens,
+                block_cache_create_tokens, block_cache_read_tokens,
+                block_cost_usd, marginal_cost_usd,
+                seven_day_pct_at_crossing, alerted_at, reset_event_id
+            )
+            SELECT id, block_id, five_hour_window_key, percent_threshold,
+                   captured_at_utc, usage_snapshot_id,
+                   block_input_tokens, block_output_tokens,
+                   block_cache_create_tokens, block_cache_read_tokens,
+                   block_cost_usd, marginal_cost_usd,
+                   seven_day_pct_at_crossing, alerted_at, reset_event_id
+              FROM five_hour_milestones_old_006
+            """
+        )
+        # Recreate the block_id index that was attached to the original
+        # table; the rename carried index metadata with the table, but
+        # the new table needs its own index entry. Safe under
+        # IF NOT EXISTS if the rename preserved it (it does in practice,
+        # but the explicit recreate is defensive).
+        conn.execute(
+            """
+            CREATE INDEX IF NOT EXISTS idx_five_hour_milestones_block
+            ON five_hour_milestones(block_id)
+            """
+        )
+        conn.execute("DROP TABLE five_hour_milestones_old_006")
+        conn.execute(
+            "INSERT OR IGNORE INTO schema_migrations (name, applied_at_utc) "
+            "VALUES (?, ?)",
+            ("006_five_hour_milestones_reset_event_id", now_utc_iso()),
+        )
+        conn.commit()
+    except Exception:
+        conn.rollback()
+        raise
+
+
 # === Region 8: Test-only migration registration (was bin/cctally:12086-12140) ===
 
 # ──────────────────────────────────────────────────────────────────────