cctally 1.7.2 → 1.7.4

package/bin/_cctally_record.py

@@ -156,25 +156,40 @@ def _cctally():
     return sys.modules["cctally"]
 
 
+# === Honest imports from extracted homes ===================================
+# Spec 2026-05-17-cctally-core-kernel-extraction.md §3.3.
+from _cctally_core import (
+    eprint,
+    now_utc_iso,
+    parse_iso_datetime,
+    open_db,
+    get_week_start_name,
+    compute_week_bounds,
+    parse_date_str,
+    _canonicalize_optional_iso,
+    make_week_ref,
+    _get_alerts_config,
+    _AlertsConfigError,
+)
+from _lib_five_hour import _canonical_5h_window_key
+from _lib_pricing import _calculate_entry_cost
+
+
 # Module-level back-ref shims. Each shim resolves
 # ``sys.modules['cctally'].X`` at CALL TIME (not bind time), so
 # monkeypatches on cctally's namespace propagate into the moved code
-# unchanged. Mirrors the precedent established in
-# ``bin/_cctally_cache.py`` and ``bin/_cctally_db.py``.
-def eprint(*args, **kwargs):
-    return sys.modules["cctally"].eprint(*args, **kwargs)
-
-
-def now_utc_iso(*args, **kwargs):
-    return sys.modules["cctally"].now_utc_iso(*args, **kwargs)
-
-
-def parse_iso_datetime(*args, **kwargs):
-    return sys.modules["cctally"].parse_iso_datetime(*args, **kwargs)
+# unchanged. `load_config` and `get_claude_session_entries` STAY as
+# shims even though their natural homes are decentralized
+# (_cctally_config / _cctally_cache) — tests monkeypatch them via
+# `ns["X"]` (21 sites total, audited 2026-05-17); direct imports would
+# silently bypass the patches.
+# See spec §3.5 (carve-out) and §3.7 (stays-on-shim allowlist).
+def load_config(*args, **kwargs):
+    return sys.modules["cctally"].load_config(*args, **kwargs)
 
 
-def open_db(*args, **kwargs):
-    return sys.modules["cctally"].open_db(*args, **kwargs)
+def get_claude_session_entries(*args, **kwargs):
+    return sys.modules["cctally"].get_claude_session_entries(*args, **kwargs)
 
 
 def open_cache_db(*args, **kwargs):
@@ -185,30 +200,6 @@ def sync_cache(*args, **kwargs):
     return sys.modules["cctally"].sync_cache(*args, **kwargs)
 
 
-def load_config(*args, **kwargs):
-    return sys.modules["cctally"].load_config(*args, **kwargs)
-
-
-def get_week_start_name(*args, **kwargs):
-    return sys.modules["cctally"].get_week_start_name(*args, **kwargs)
-
-
-def compute_week_bounds(*args, **kwargs):
-    return sys.modules["cctally"].compute_week_bounds(*args, **kwargs)
-
-
-def parse_date_str(*args, **kwargs):
-    return sys.modules["cctally"].parse_date_str(*args, **kwargs)
-
-
-def _canonicalize_optional_iso(*args, **kwargs):
-    return sys.modules["cctally"]._canonicalize_optional_iso(*args, **kwargs)
-
-
-def _canonical_5h_window_key(*args, **kwargs):
-    return sys.modules["cctally"]._canonical_5h_window_key(*args, **kwargs)
-
-
 def _floor_to_hour(*args, **kwargs):
     return sys.modules["cctally"]._floor_to_hour(*args, **kwargs)
 
@@ -245,22 +236,10 @@ def insert_percent_milestone(*args, **kwargs):
     return sys.modules["cctally"].insert_percent_milestone(*args, **kwargs)
 
 
-def make_week_ref(*args, **kwargs):
-    return sys.modules["cctally"].make_week_ref(*args, **kwargs)
-
-
 def cmd_sync_week(*args, **kwargs):
     return sys.modules["cctally"].cmd_sync_week(*args, **kwargs)
 
 
-def _calculate_entry_cost(*args, **kwargs):
-    return sys.modules["cctally"]._calculate_entry_cost(*args, **kwargs)
-
-
-def get_claude_session_entries(*args, **kwargs):
-    return sys.modules["cctally"].get_claude_session_entries(*args, **kwargs)
-
-
 def _resolve_primary_model_for_block(*args, **kwargs):
     return sys.modules["cctally"]._resolve_primary_model_for_block(*args, **kwargs)
 
@@ -281,10 +260,6 @@ def _dispatch_alert_notification(*args, **kwargs):
     return sys.modules["cctally"]._dispatch_alert_notification(*args, **kwargs)
 
 
-def _get_alerts_config(*args, **kwargs):
-    return sys.modules["cctally"]._get_alerts_config(*args, **kwargs)
-
-
 def _warn_alerts_bad_config_once(*args, **kwargs):
     return sys.modules["cctally"]._warn_alerts_bad_config_once(*args, **kwargs)
 
@@ -372,6 +347,47 @@ def _normalize_percent(value: "float | int | None") -> "float | None":
     return round(float(value), _PERCENT_NORMALIZE_DECIMALS)
 
 
+def _resolve_active_five_hour_reset_event_id(
+    conn: "sqlite3.Connection",
+    five_hour_window_key: int,
+) -> int:
+    """Return ``id`` of the most-recent ``five_hour_reset_events`` row for
+    ``five_hour_window_key``, else 0 (pre-credit / no-event sentinel).
+
+    Mirrors the weekly active-segment resolution pattern used by
+    ``maybe_record_milestone`` for ``percent_milestones.reset_event_id``.
+    Called once per ``maybe_update_five_hour_block`` invocation and the
+    return value is threaded through every read/write site that keys on
+    ``(five_hour_window_key, percent_threshold)`` so post-credit threshold
+    crossings land as a distinct row from any pre-credit one at the same
+    threshold. See spec
+    docs/superpowers/specs/2026-05-16-5h-in-place-credit-detection.md §3.3.
+
+    Returns ``0`` when:
+      - The window has no ``five_hour_reset_events`` row (most blocks).
+      - The table doesn't exist yet (DB predates this feature).
+
+    Returns the largest ``id`` matching the window otherwise; the
+    ``ORDER BY id DESC LIMIT 1`` clause is what *defines* "active" in
+    the stacked-credit case (spec §2.3 — multiple events across distinct
+    10-min slots): pre-credit milestones key on ``seg=0``, milestones
+    between credit 1 and credit 2 key on event-1's id, and milestones
+    after credit 2 key on event-2's id.
+    """
+    try:
+        row = conn.execute(
+            "SELECT id FROM five_hour_reset_events "
+            "WHERE five_hour_window_key = ? "
+            "ORDER BY id DESC LIMIT 1",
+            (int(five_hour_window_key),),
+        ).fetchone()
+    except sqlite3.DatabaseError:
+        return 0
+    if row is None:
+        return 0
+    return int(row["id"])
+
+
 def maybe_record_milestone(
     saved: dict[str, Any],
 ) -> None:
@@ -491,7 +507,7 @@ def maybe_record_milestone(
         # the underlying problem is config-wide, not axis-specific.
         try:
             alerts_cfg: "dict | None" = _get_alerts_config(load_config())
-        except sys.modules["cctally"]._AlertsConfigError as exc:
+        except _AlertsConfigError as exc:
             _warn_alerts_bad_config_once(exc)
             alerts_cfg = None
 
@@ -762,7 +778,7 @@ def maybe_update_five_hour_block(saved: dict[str, Any]) -> None:
         cfg_for_alerts = load_config()
         try:
             alerts_cfg: "dict | None" = _get_alerts_config(cfg_for_alerts)
-        except sys.modules["cctally"]._AlertsConfigError as exc:
+        except _AlertsConfigError as exc:
             _warn_alerts_bad_config_once(exc)
             alerts_cfg = None
         # Resolve display.tz once (shares the cfg load above). Threaded
@@ -963,7 +979,23 @@ def maybe_update_five_hour_block(saved: dict[str, Any]) -> None:
             # Snap-up-by-1e-9 per the gotcha: 0.50 * 100 == 49.99...9 in
             # IEEE-754, so bare math.floor would miss the 50 threshold.
             current_floor = math.floor(float(five_hour_percent) + 1e-9)
+
+            # Resolve active segment ONCE so every per-site read + write
+            # below sees the same value within this transaction. Spec
+            # §3.3 & §3.4 of
+            # docs/superpowers/specs/2026-05-16-5h-in-place-credit-detection.md:
+            # the active segment is the latest five_hour_reset_events row
+            # for this window_key, else sentinel 0 (pre-credit).
+            active_reset_event_id = _resolve_active_five_hour_reset_event_id(
+                conn, int(five_hour_window_key)
+            )
+
             if current_floor >= 1:
+                # Site A — MAX(percent_threshold) scoped to active segment.
+                # Without the reset_event_id filter, MAX returns the
+                # pre-credit max and post-credit milestones from 1..max
+                # are silently never emitted.
+                #
                 # Use max(percent_threshold) directly (not prior block's
                 # final_pct) so first-observation already-mid-stream doesn't
                 # synthesize crossings 1..(current_floor - 1) we never had
@@ -971,8 +1003,8 @@ def maybe_update_five_hour_block(saved: dict[str, Any]) -> None:
                 # maybe_record_milestone's max_existing path.
                 row = conn.execute(
                     "SELECT MAX(percent_threshold) AS m FROM five_hour_milestones "
-                    "WHERE five_hour_window_key = ?",
-                    (int(five_hour_window_key),),
+                    "WHERE five_hour_window_key = ? AND reset_event_id = ?",
+                    (int(five_hour_window_key), active_reset_event_id),
                 ).fetchone()
                 max_existing = row["m"] if row and row["m"] is not None else None
 
@@ -985,14 +1017,21 @@ def maybe_update_five_hour_block(saved: dict[str, Any]) -> None:
                     # block_id was resolved above (before the children writes) and
                     # is still in scope here.
 
+                    # Site B — prior-cost lookup scoped to active segment.
                     # Marginal-cost lookup for the start_threshold milestone
                     # (only when there's a prior milestone in this block).
+                    # Without the reset_event_id filter, marginal could be
+                    # computed against a pre-credit row whose block_cost is
+                    # unrelated to the post-credit segment's totals.
                     prior_cost: float | None = None
                     if max_existing is not None:
                         prev_row = conn.execute(
                             "SELECT block_cost_usd FROM five_hour_milestones "
-                            "WHERE five_hour_window_key = ? AND percent_threshold = ?",
-                            (int(five_hour_window_key), int(max_existing)),
+                            "WHERE five_hour_window_key = ? "
+                            "  AND percent_threshold = ? "
+                            "  AND reset_event_id = ?",
+                            (int(five_hour_window_key), int(max_existing),
+                             active_reset_event_id),
                         ).fetchone()
                         if prev_row is not None:
                             prior_cost = float(prev_row["block_cost_usd"])
@@ -1002,6 +1041,12 @@ def maybe_update_five_hour_block(saved: dict[str, Any]) -> None:
                             marginal: float | None = totals["cost_usd"] - prior_cost
                         else:
                             marginal = None
+                        # Site C — INSERT stamps the resolved
+                        # ``active_reset_event_id`` (0 = pre-credit, else
+                        # the latest five_hour_reset_events.id). UNIQUE
+                        # is now (window_key, threshold, reset_event_id)
+                        # so post-credit threshold crossings re-fire
+                        # fresh — not absorbed into the pre-credit row.
                         cur = conn.execute(
                             """
                             INSERT OR IGNORE INTO five_hour_milestones (
@@ -1016,9 +1061,10 @@ def maybe_update_five_hour_block(saved: dict[str, Any]) -> None:
                               block_cache_read_tokens,
                               block_cost_usd,
                               marginal_cost_usd,
-                              seven_day_pct_at_crossing
+                              seven_day_pct_at_crossing,
+                              reset_event_id
                             )
-                            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
                             """,
                             (
                                 block_id,
@@ -1033,6 +1079,7 @@ def maybe_update_five_hour_block(saved: dict[str, Any]) -> None:
                                 totals["cost_usd"],
                                 marginal,
                                 weekly_percent,
+                                active_reset_event_id,
                             ),
                         )
                         # ── Threshold-actions dispatch (set-then-dispatch, spec §3.2) ──
@@ -1061,11 +1108,19 @@ def maybe_update_five_hour_block(saved: dict[str, Any]) -> None:
                             and pct in alerts_cfg["five_hour_thresholds"]
                         ):
                             crossed_at = now_utc_iso()
+                            # Site D — alerted_at UPDATE scoped to the
+                            # active segment, so the post-credit row
+                            # gets stamped without overwriting an
+                            # already-alerted pre-credit row at the
+                            # same threshold.
                             conn.execute(
                                 "UPDATE five_hour_milestones SET alerted_at = ? "
-                                "WHERE five_hour_window_key = ? AND percent_threshold = ? "
-                                "AND alerted_at IS NULL",
-                                (crossed_at, int(five_hour_window_key), int(pct)),
+                                "WHERE five_hour_window_key = ? "
+                                "  AND percent_threshold = ? "
+                                "  AND reset_event_id = ? "
+                                "  AND alerted_at IS NULL",
+                                (crossed_at, int(five_hour_window_key),
+                                 int(pct), active_reset_event_id),
                             )
                             # Cheap re-reads inside BEGIN are SELECT-only and
                             # safe; values reflect post-INSERT state. We
@@ -1073,10 +1128,17 @@ def maybe_update_five_hour_block(saved: dict[str, Any]) -> None:
                             # are in scope) and defer ONLY the Popen-side
                             # _dispatch_alert_notification to after the outer
                             # commit.
+                            # Site E — alert-payload reread scoped to
+                            # the active segment so the dispatch shows
+                            # post-credit cost, not the pre-credit
+                            # row's stale value at the same threshold.
                             cost_row = conn.execute(
                                 "SELECT block_cost_usd FROM five_hour_milestones "
-                                "WHERE five_hour_window_key = ? AND percent_threshold = ?",
-                                (int(five_hour_window_key), int(pct)),
+                                "WHERE five_hour_window_key = ? "
+                                "  AND percent_threshold = ? "
+                                "  AND reset_event_id = ?",
+                                (int(five_hour_window_key), int(pct),
+                                 active_reset_event_id),
                             ).fetchone()
                             block_row = conn.execute(
                                 "SELECT block_start_at FROM five_hour_blocks "
@@ -1393,9 +1455,9 @@ def cmd_record_usage(args: argparse.Namespace) -> int:
                             "WHERE new_week_end_at = ? LIMIT 1",
                             (cur_end_canon,),
                         ).fetchone()
+                        effective_dt = _floor_to_hour(now_utc)
+                        effective_iso = effective_dt.isoformat(timespec="seconds")
                         if already is None:
-                            effective_dt = _floor_to_hour(now_utc)
-                            effective_iso = effective_dt.isoformat(timespec="seconds")
                             # Row shape: old=effective_iso, new=cur_end_canon
                             # (distinct values). The previous shape stored
                             # old==new==cur_end_canon, which let BOTH
@@ -1413,64 +1475,318 @@ def cmd_record_usage(args: argparse.Namespace) -> int:
                             # UNIQUE(old, new) constraint permits this
                             # row, and the pre-check above keys on
                             # new_week_end_at so dedup still works.
+                            # Stamp ``observed_pre_credit_pct = prior_pct``
+                            # (issue #45): durable record of the pre-credit
+                            # baseline we observed at write time. Decouples
+                            # any future cleanup tooling from re-deriving
+                            # prior_pct via SELECT. Existing rows from
+                            # migration 007 carry NULL.
                             conn.execute(
                                 "INSERT OR IGNORE INTO week_reset_events "
                                 "(detected_at_utc, old_week_end_at, new_week_end_at, "
-                                " effective_reset_at_utc) VALUES (?, ?, ?, ?)",
+                                " effective_reset_at_utc, observed_pre_credit_pct) "
+                                "VALUES (?, ?, ?, ?, ?)",
                                 (now_utc_iso(), effective_iso, cur_end_canon,
-                                 effective_iso),
+                                 effective_iso, float(prior_pct)),
                             )
                             conn.commit()
-                            # Force-write hwm-7d so the next status-line
-                            # render reflects the post-credit value. The
-                            # monotonic guard at the normal write site (below)
-                            # would refuse to decrease the file; this write
-                            # is the credit-only escape hatch. Lands AFTER
-                            # the conn.commit() so a concurrent record-usage
-                            # reader doesn't see the new HWM before the
-                            # event row is durable.
+                        # Pivots fire UNCONDITIONALLY whenever a credit
+                        # is detected — they're NOT gated on
+                        # ``already is None``. Memory
+                        # ``project_dedup_must_not_gate_side_effects.md``:
+                        # "Skipping a no-op INSERT must NOT skip
+                        # milestones/rollups/alerts; prior run may have
+                        # died mid-flight." Crash scenario: tick N
+                        # committed the event row, then died before
+                        # HWM + DELETE. Tick N+1's pre-check sees
+                        # ``already`` non-None (the row IS in the
+                        # table) and would skip the pivots, leaving
+                        # the system wedged on pre-credit HWM + stale-
+                        # replica rows. Pivots are individually
+                        # idempotent (file overwrite + DELETE on stable
+                        # predicate), so re-running them is safe.
+                        # ``effective_iso`` is resolved above; on a
+                        # recovery tick it lands on the SAME 10-min
+                        # slot as the original (now_utc has drifted
+                        # only seconds), so the DELETE predicate's
+                        # ``unixepoch(captured_at_utc) >= unixepoch(?)``
+                        # still matches every stale-replica row.
+                        #
+                        # Force-write hwm-7d so the next status-line
+                        # render reflects the post-credit value. The
+                        # monotonic guard at the normal write site
+                        # (below) would refuse to decrease the file;
+                        # this write is the credit-only escape hatch.
+                        # Lands AFTER the conn.commit() so a concurrent
+                        # record-usage reader doesn't see the new HWM
+                        # before the event row is durable.
+                        try:
+                            (c.APP_DIR / "hwm-7d").write_text(
+                                f"{week_start_date} {weekly_percent}\n"
+                            )
+                        except OSError:
+                            pass
+
+                        # Race-defensive cleanup. Between the moment
+                        # Anthropic credited the user (effective_iso)
+                        # and this code firing, the EXTERNAL
+                        # claude-statusline tool can replay stale
+                        # pre-credit `--percent` values (it has its
+                        # own in-memory HWM cache and re-runs us once
+                        # per status-line tick). Those replays land
+                        # captured_at_utc >= effective_iso with
+                        # weekly_percent near prior_pct (the pre-credit
+                        # value), and they dominate the reset-aware
+                        # clamp's MAX over the post-credit segment so
+                        # legitimate fresh OAuth values are rejected.
+                        # 1.0pp tolerance band (issue #45) around the
+                        # observed pre-credit baseline absorbs any
+                        # rounding drift between cctally's OAuth read
+                        # and statusline's --percent payload (today
+                        # they match byte-identically, but the band
+                        # future-proofs against Anthropic or statusline
+                        # changing rounding). The band stays well below
+                        # the 25pp in-place credit detection threshold,
+                        # so legitimate post-credit values are never
+                        # caught. Bind is the in-scope ``prior_pct``,
+                        # which equals the just-stamped
+                        # ``observed_pre_credit_pct`` on the event row.
+                        try:
+                            conn.execute(
+                                "DELETE FROM weekly_usage_snapshots "
+                                "WHERE week_start_date = ? "
+                                "  AND unixepoch(captured_at_utc) >= "
+                                "      unixepoch(?) "
+                                "  AND ABS(weekly_percent - ?) < 1.0",
+                                (week_start_date, effective_iso,
+                                 float(prior_pct)),
+                            )
+                            conn.commit()
+                        except sqlite3.DatabaseError as exc:
+                            eprint(
+                                "[record-usage] post-credit cleanup "
+                                f"failed: {exc}"
+                            )
+
+            # ── 5h in-place credit detection (parallel to weekly above) ──
+            # Spec §2.2 of
+            # docs/superpowers/specs/2026-05-16-5h-in-place-credit-detection.md.
+            # Slot SECOND so the weekly branch retains control-flow
+            # priority — both branches are independent (they touch
+            # different tables) and the order has no behavioral
+            # interaction. Same outer try/except wraps both so a
+            # 5h-detection failure logs but does not regress the rest
+            # of cmd_record_usage.
+            #
+            # Diverges from weekly in three places:
+            #   - Threshold: 5.0pp (constant on cctally module), not 25.0pp.
+            #     The 5h envelope is smaller so a 5pp move is
+            #     proportionally larger.
+            #   - Effective-iso floor: 10-min (matches
+            #     ``_canonical_5h_window_key``'s 600s floor), not hour.
+            #     Up to ~30 distinct slots per 5h block; same-slot
+            #     collisions absorbed by UNIQUE per spec §2.3.
+            #   - Pre-check: pair-checks the latest event's
+            #     ``(prior_percent, post_percent)`` against this tick's
+            #     ``(prior_5h_pct, five_hour_percent)``, not
+            #     ``new_week_end_at`` equality. A genuine replay matches
+            #     BOTH fields; a NEW credit-with-idle (prior_pct equals
+            #     the prior credit's post_pct because the user didn't
+            #     move between credits) matches only one field and
+            #     correctly proceeds to write a second event row.
+            try:
+                if (
+                    five_hour_window_key is not None
+                    and five_hour_percent is not None
+                ):
+                    prior_5h_row = conn.execute(
+                        "SELECT five_hour_window_key, five_hour_percent, "
+                        "       five_hour_resets_at "
+                        "  FROM weekly_usage_snapshots "
+                        " WHERE five_hour_window_key IS NOT NULL "
+                        "   AND five_hour_percent IS NOT NULL "
+                        " ORDER BY captured_at_utc DESC, id DESC LIMIT 1"
+                    ).fetchone()
+                    if (
+                        prior_5h_row is not None
+                        and int(prior_5h_row["five_hour_window_key"])
+                            == int(five_hour_window_key)
+                        and prior_5h_row["five_hour_resets_at"] is not None
+                    ):
+                        prior_5h_pct = float(prior_5h_row["five_hour_percent"])
+                        prior_5h_resets_dt = parse_iso_datetime(
+                            prior_5h_row["five_hour_resets_at"],
+                            "prior.five_hour_resets_at",
+                        )
+                        # ``now_utc`` was bound earlier in this same
+                        # outer try block from
+                        # ``dt.datetime.now(dt.timezone.utc)``; reuse it
+                        # so both branches see the same instant.
+                        if (
+                            prior_5h_resets_dt > now_utc
+                            and (prior_5h_pct - float(five_hour_percent))
+                                >= c._FIVE_HOUR_RESET_PCT_DROP_THRESHOLD
+                        ):
+                            # Pair-check dedup pre-check (spec §2.2;
+                            # refined by Codex r4 P1 finding). The
+                            # round-1 predicate compared only the
+                            # latest event's ``post_percent`` against
+                            # this tick's ``prior_5h_pct``; that
+                            # false-positived on a legitimate 2nd
+                            # credit where the user was idle between
+                            # credits (Credit 1 lands prior=20/post=5;
+                            # user does nothing; Credit 2 arrives with
+                            # CLI percent=0 so prior_5h_pct=5 reads
+                            # equal to stored post_percent=5 →
+                            # silently swallowed). Pair-checking
+                            # against BOTH fields disambiguates: a
+                            # genuine replay matches BOTH; a new
+                            # credit-with-idle matches at most ONE
+                            # (the prior side coincides but
+                            # post_percent differs).
+                            most_recent = conn.execute(
+                                "SELECT prior_percent, post_percent "
+                                "  FROM five_hour_reset_events "
+                                " WHERE five_hour_window_key = ? "
+                                " ORDER BY id DESC LIMIT 1",
+                                (int(five_hour_window_key),),
+                            ).fetchone()
+                            is_dup = (
+                                most_recent is not None
+                                and round(prior_5h_pct, 1)
+                                == round(float(most_recent["prior_percent"]), 1)
+                                and round(float(five_hour_percent), 1)
+                                == round(float(most_recent["post_percent"]), 1)
+                            )
+                            # 10-min floor (spec §2.3 — bounded
+                            # stacked-credit resolution; one event per
+                            # 10-min slot per block). Resolved BEFORE
+                            # the ``if not is_dup`` branch so it's in
+                            # scope for the pivots below (per memory
+                            # ``project_dedup_must_not_gate_side_effects.md``:
+                            # the recovery-tick path must still force
+                            # HWM + DELETE even when the INSERT is
+                            # absorbed by the pre-check or by
+                            # UNIQUE — see comment below for the
+                            # crash scenario). ``_floor_to_ten_minutes``
+                            # is a cctally module attribute; the
+                            # ``c.X`` accessor resolves at call time
+                            # so test ``monkeypatch.setitem(ns,
+                            # "_floor_to_ten_minutes", …)``
+                            # propagates.
+                            effective_dt = c._floor_to_ten_minutes(now_utc)
+                            effective_iso = effective_dt.isoformat(
+                                timespec="seconds"
+                            )
+                            if not is_dup:
+                                conn.execute(
+                                    "INSERT OR IGNORE INTO five_hour_reset_events "
+                                    "(detected_at_utc, five_hour_window_key, "
+                                    " prior_percent, post_percent, "
+                                    " effective_reset_at_utc) "
+                                    "VALUES (?, ?, ?, ?, ?)",
+                                    (
+                                        now_utc_iso(),
+                                        int(five_hour_window_key),
+                                        prior_5h_pct,
+                                        float(five_hour_percent),
+                                        effective_iso,
+                                    ),
+                                )
+                                conn.commit()
+                            # Pivots fire UNCONDITIONALLY whenever a
+                            # credit is detected — NOT gated on
+                            # ``not is_dup`` and NOT on
+                            # ``rowcount == 1``. Memory
+                            # ``project_dedup_must_not_gate_side_effects.md``:
+                            # "Skipping a no-op INSERT must NOT skip
+                            # milestones/rollups/alerts; prior run may
+                            # have died mid-flight." Crash scenario A:
+                            # tick N committed the event row, then died
+                            # before HWM + DELETE. Tick N+1's
+                            # INSERT OR IGNORE returns rowcount == 0
+                            # (UNIQUE absorbs) but the system is still
+                            # wedged on the pre-credit HWM + stale-
+                            # replica rows. Crash scenario B (the
+                            # Codex r4 finding): a recovery tick where
+                            # ``(prior, post)`` pair-matches the
+                            # already-stored event row also takes the
+                            # ``is_dup`` branch; without the hoist the
+                            # pivots would be skipped and the system
+                            # would stay wedged. The pivots are
+                            # individually idempotent (file overwrite
+                            # + DELETE on a stable predicate), so
+                            # re-running them on the recovery tick is
+                            # always safe. Mirrors the weekly hoist at
+                            # ``_cctally_record.py`` after the
+                            # ``if already is None`` block (grep
+                            # ``Force-write hwm-7d``).
+                            #
+                            # Force-write hwm-5h: bypasses the
+                            # monotonic guard at the normal hwm-5h
+                            # writer below. Lands AFTER
+                            # ``conn.commit()`` so a concurrent reader
+                            # doesn't see the new HWM before the
+                            # event row is durable. File format
+                            # matches the canonical writer:
+                            # ``<key> <percent>\n``.
                             try:
-                                (c.APP_DIR / "hwm-7d").write_text(
-                                    f"{week_start_date} {weekly_percent}\n"
+                                (c.APP_DIR / "hwm-5h").write_text(
+                                    f"{int(five_hour_window_key)} "
+                                    f"{float(five_hour_percent)}\n"
                                 )
                             except OSError:
                                 pass
-
-                            # Race-defensive cleanup. Between the moment
-                            # Anthropic credited the user (effective_iso)
-                            # and this code firing, the EXTERNAL
-                            # claude-statusline tool can replay stale
-                            # pre-credit `--percent` values (it has its
-                            # own in-memory HWM cache and re-runs us once
-                            # per status-line tick). Those replays land
-                            # captured_at_utc >= effective_iso with
-                            # weekly_percent == prior_pct (the pre-credit
-                            # value), and they dominate the reset-aware
-                            # clamp's MAX over the post-credit segment so
-                            # legitimate fresh OAuth values are rejected.
-                            # Strict equality (round(.,1)) keeps this
-                            # narrow: we only delete rows whose percent
-                            # exactly matches the pre-credit value we just
-                            # observed — legitimate post-credit climbs
-                            # past `prior_pct` (rare, but possible if the
-                            # credit is small + activity is heavy) stay.
+                            # Stale-replica DELETE (spec §4.3).
+                            # Defends against claude-statusline
+                            # replaying the pre-credit
+                            # ``--five-hour-percent`` value past the
+                            # credit moment from its own in-memory
+                            # HWM cache. 1.0pp tolerance band (issue
+                            # #48 — symmetric follow-up to weekly #45)
+                            # around the observed pre-credit baseline
+                            # absorbs any rounding drift between
+                            # cctally's OAuth read and statusline's
+                            # ``--five-hour-percent`` payload (today
+                            # they match byte-identically, but the
+                            # band future-proofs against Anthropic or
+                            # statusline changing 5h rounding). The
+                            # band stays well below the 5.0pp 5h
+                            # in-place credit detection threshold
+                            # (``_FIVE_HOUR_RESET_PCT_DROP_THRESHOLD``)
+                            # — 4pp safety margin — so legitimate
+                            # post-credit values are never caught.
+                            # ``unixepoch()`` on both sides for offset
+                            # robustness (Z vs +00:00). Bind is the
+                            # in-scope ``prior_5h_pct``, which equals
+                            # the just-stamped
+                            # ``five_hour_reset_events.prior_percent``
+                            # on the event row.
                             try:
                                 conn.execute(
                                     "DELETE FROM weekly_usage_snapshots "
-                                    "WHERE week_start_date = ? "
-                                    "  AND unixepoch(captured_at_utc) >= "
-                                    "      unixepoch(?) "
-                                    "  AND round(weekly_percent, 1) = "
-                                    "      round(?, 1)",
-                                    (week_start_date, effective_iso,
-                                     float(prior_pct)),
+                                    " WHERE five_hour_window_key = ? "
+                                    "   AND unixepoch(captured_at_utc) "
+                                    "       >= unixepoch(?) "
+                                    "   AND ABS(five_hour_percent - ?) "
+                                    "       < 1.0",
+                                    (
+                                        int(five_hour_window_key),
+                                        effective_iso,
+                                        prior_5h_pct,
+                                    ),
                                 )
                                 conn.commit()
                             except sqlite3.DatabaseError as exc:
                                 eprint(
-                                    "[record-usage] post-credit cleanup "
-                                    f"failed: {exc}"
+                                    "[record-usage] 5h post-credit "
+                                    f"cleanup failed: {exc}"
                                 )
+            except (sqlite3.DatabaseError, ValueError, TypeError) as exc:
+                eprint(
+                    f"[record-usage] 5h in-place-credit detection "
+                    f"failed: {exc}"
+                )
         except (sqlite3.DatabaseError, ValueError) as exc:
             eprint(f"[record-usage] reset-event detection failed: {exc}")
 
@@ -1511,19 +1827,54 @@ def cmd_record_usage(args: argparse.Namespace) -> int:
         if max_row and max_row["v"] is not None and round(weekly_percent, 1) < round(float(max_row["v"]), 1):
             should_insert = False
         else:
-            # 5-hour usage is monotonically non-decreasing within a window.
-            # A lower value means stale API data; clamp to existing max.
-            # Joining on five_hour_window_key (canonical 10-min-floored
+            # 5-hour usage is monotonically non-decreasing within a window
+            # — UNTIL an in-place 5h credit fires. When a
+            # ``five_hour_reset_events`` row exists for THIS
+            # ``five_hour_window_key``, the MAX query filters to samples
+            # captured at-or-after the event's ``effective_reset_at_utc``
+            # so a fresh post-credit OAuth value (e.g. 4%) lands instead
+            # of being re-clamped to the pre-credit max (e.g. 28%). When
+            # no event row exists, ``COALESCE`` defaults to epoch-zero so
+            # the filter is a no-op and legacy clamp behavior is preserved
+            # byte-identically.
+            #
+            # ``unixepoch()`` on BOTH sides for offset robustness — stored
+            # ``captured_at_utc`` carries ``Z`` while
+            # ``effective_reset_at_utc`` carries ``+00:00``. Lex compare
+            # would silently mis-order moments for non-UTC hosts (same
+            # gotcha as the weekly clamp / 5h-block cross-reset flag).
+            #
+            # Joining on ``five_hour_window_key`` (canonical 10-min-floored
             # epoch) absorbs Anthropic's seconds-level jitter on
-            # resets_at; an ISO-string equality at this site silently
+            # ``resets_at``; an ISO-string equality at this site silently
             # skipped the clamp every time a jittered fetch landed in
             # the same physical 5h window (spec Bug B).
+            #
+            # Spec §4.1 of
+            # docs/superpowers/specs/2026-05-16-5h-in-place-credit-detection.md.
             if five_hour_percent is not None and five_hour_window_key is not None:
                 max_5h_row = conn.execute(
-                    "SELECT MAX(five_hour_percent) AS v FROM weekly_usage_snapshots WHERE five_hour_window_key = ?",
-                    (five_hour_window_key,),
+                    """
+                    SELECT MAX(five_hour_percent) AS v
+                      FROM weekly_usage_snapshots
+                     WHERE five_hour_window_key = ?
+                       AND unixepoch(captured_at_utc) >= unixepoch(COALESCE(
+                         (SELECT effective_reset_at_utc
+                            FROM five_hour_reset_events
+                           WHERE five_hour_window_key = ?
+                           ORDER BY id DESC
+                           LIMIT 1),
+                         '1970-01-01T00:00:00Z'
+                       ))
+                    """,
+                    (int(five_hour_window_key), int(five_hour_window_key)),
                 ).fetchone()
-                if max_5h_row and max_5h_row["v"] is not None and round(five_hour_percent, 1) < round(float(max_5h_row["v"]), 1):
+                if (
+                    max_5h_row
+                    and max_5h_row["v"] is not None
+                    and round(five_hour_percent, 1)
+                        < round(float(max_5h_row["v"]), 1)
+                ):
                     five_hour_percent = float(max_5h_row["v"])
 
             # Dedup vs last snapshot: if BOTH weekly_percent and
@@ -1627,6 +1978,16 @@ def cmd_record_usage(args: argparse.Namespace) -> int:
                 # last_observed_at_utc is stale relative to the latest
                 # snapshot's captured_at_utc (the kill landed between
                 # insert_usage_snapshot and maybe_update_five_hour_block).
+                #
+                # Round-3: ALSO scope the milestone-coverage half of
+                # this probe by ACTIVE 5h SEGMENT. Without this, a
+                # credited block's MAX over the whole milestone ledger
+                # would still read the pre-credit ceiling (e.g. 28%) and
+                # silently suppress the post-credit ledger's heal even
+                # though it has zero rows. Mirrors weekly Probe 1's
+                # segment-aware fix above. Uses
+                # ``_resolve_active_five_hour_reset_event_id`` to find
+                # the active segment for the latest snapshot's window.
                 need_5h_heal = False
                 window_key = latest_row["five_hour_window_key"]
                 if window_key is not None:
@@ -1643,6 +2004,45 @@ def cmd_record_usage(args: argparse.Namespace) -> int:
                         < latest_row["captured_at_utc"]
                     ):
                         need_5h_heal = True
+                    else:
+                        # Block row exists AND last_observed is fresh
+                        # — but the post-credit milestone segment may
+                        # still owe rows. Scope MAX(percent_threshold)
+                        # by the active reset_event_id segment so
+                        # post-credit climbs from threshold 1 trigger
+                        # heal even when the pre-credit segment already
+                        # crossed higher thresholds. Probe shape mirrors
+                        # weekly Probe 1 (lines 1922-1956).
+                        five_hour_percent_for_probe = latest_row[
+                            "five_hour_percent"
+                        ]
+                        if five_hour_percent_for_probe is not None:
+                            latest_5h_floor = math.floor(
+                                float(five_hour_percent_for_probe) + 1e-9
+                            )
+                            if latest_5h_floor >= 1:
+                                heal_5h_segment = (
+                                    _resolve_active_five_hour_reset_event_id(
+                                        heal_conn, int(window_key)
+                                    )
+                                )
+                                max_5h_existing = heal_conn.execute(
+                                    "SELECT MAX(percent_threshold) AS m "
+                                    "FROM five_hour_milestones "
+                                    "WHERE five_hour_window_key = ? "
+                                    "  AND reset_event_id = ?",
+                                    (int(window_key), heal_5h_segment),
+                                ).fetchone()
+                                if (
+                                    max_5h_existing is None
+                                    or max_5h_existing["m"] is None
+                                ):
+                                    need_5h_heal = True
+                                elif (
+                                    int(max_5h_existing["m"])
+                                    < latest_5h_floor
+                                ):
+                                    need_5h_heal = True
             finally:
                 heal_conn.close()