claude-mem-lite 3.43.0 → 3.45.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "claude-mem-lite",
-      "version": "3.43.0",
+      "version": "3.45.0",
       "source": "./",
       "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark)."
     }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.43.0",
+  "version": "3.45.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "author": {
     "name": "sdsrss"

package/cli/common.mjs

@@ -209,5 +209,6 @@ export function formatProbeHints(probe) {
   if (probe.obs.length > 0)     hints.push(`#${probe.obs.join(', #')} (obs)`);
   if (probe.session.length > 0) hints.push(`S#${probe.session.join(', S#')} (session)`);
   if (probe.prompt.length > 0)  hints.push(`P#${probe.prompt.join(', P#')} (prompt)`);
+  if (probe.event?.length > 0)  hints.push(`E#${probe.event.join(', E#')} (event)`);
   return hints;
 }

package/hook-update.mjs

@@ -3,7 +3,7 @@
 // Skips in dev mode (symlinked installs). Silent on network failure.
 
 import { execSync, execFileSync } from 'node:child_process';
-import { readFileSync, writeFileSync, copyFileSync, cpSync, readdirSync, existsSync, lstatSync, mkdirSync, rmSync, renameSync, chmodSync } from 'node:fs';
+import { readFileSync, writeFileSync, copyFileSync, cpSync, readdirSync, existsSync, lstatSync, mkdirSync, mkdtempSync, rmSync, renameSync, chmodSync } from 'node:fs';
 import { join, dirname, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { tmpdir, homedir } from 'node:os';
@@ -305,12 +305,22 @@ async function loadReleaseManifest(sourceDir) {
   }
 }
 
+// Create a private (0700), unpredictably-named staging dir under the system tmpdir.
+// mkdtempSync is atomic and owner-only, closing the predictable-name TOCTOU the old
+// `join(tmpdir(), \`...-${Date.now()}\`)` + mkdirSync(recursive) left open: in a
+// world-writable /tmp a local user could pre-create or symlink that guessable path before
+// we downloaded the tarball / ran validate→install into it. mkdirSync(recursive) succeeds
+// on an existing (attacker-owned) dir; mkdtempSync fails closed unless it creates a fresh
+// one. Mirrors the repair() path (install.mjs) which already uses mkdtempSync. (P3-4)
+export function createUpdateTmpDir() {
+  return mkdtempSync(join(tmpdir(), 'claude-mem-lite-update-'));
+}
+
 // ── Download & Install ─────────────────────────────────────
 // Direct file copy instead of running old install.mjs (avoids symlink overwrite in dev)
 async function downloadAndInstall(tarballUrl, expectedVersion, assets = []) {
-  const tmpDir = join(tmpdir(), `claude-mem-lite-update-${Date.now()}`);
+  const tmpDir = createUpdateTmpDir();
   try {
-    mkdirSync(tmpDir, { recursive: true });
 
     // Download tarball via curl (available on all supported platforms)
     // Validate URL to prevent command injection via crafted tarball URLs
@@ -389,6 +399,19 @@ export function validateExtractedTarball(sourceDir, expectedVersion, expectedNam
   return { ok: true };
 }
 
+// Pure downgrade-guard predicate (exported for unit testing). True when `relVersion` is
+// strictly OLDER than the installed `localVersion`. Under signing an attacker cannot forge a
+// release, but CAN replay an older validly-signed one (a since-patched version) by pinning the
+// GitHub "latest" API response — so repair(), which installs whatever fetchLatestRelease()
+// resolves, must refuse to move BACKWARD (parity with checkForUpdate, which only installs when
+// compareVersions(latest,current) > 0). A null/unknown local version (a broken install that
+// genuinely needs repair, or an unreadable package.json) is allowed through — fail toward
+// recoverability, since the signature check downstream still gates authenticity. (P3-3)
+export function isRepairDowngrade(relVersion, localVersion) {
+  if (!relVersion || !localVersion) return false;
+  return compareVersions(relVersion, localVersion) < 0;
+}
+
 // ── Release signature verification (P1 supply-chain hardening) ──────────────
 // Embedded Ed25519 PUBLIC key (SPKI PEM). ACTIVE since v3.20.0 — auto-update now
 // FAILS CLOSED: a release missing valid signature assets is refused (the matching

package/hook.mjs

@@ -47,7 +47,7 @@ import { handleLLMEpisode, handleLLMSummary, saveObservation, buildImmediateObse
 import { scrubRecord } from './lib/scrub-record.mjs';
 import { formatHookError } from './lib/native-binding-hint.mjs';
 import { selectCompressionCandidates, groupByProjectWeek, compressGroup } from './lib/compress-core.mjs';
-import { cleanupBroken, decayAndMarkIdle, boostAccessed, selectFuzzyDedupeIds, hardDeleteCandidateCount, purgeStale, recoverOrphanedChildren, recoverBuriedLessons } from './lib/maintain-core.mjs';
+import { cleanupBroken, decayAndMarkIdle, boostAccessed, selectFuzzyDedupeIds, hardDeleteCandidateCount, purgeStale, recoverOrphanedChildren, recoverBuriedLessons, sweepDeferredWorkOrphans } from './lib/maintain-core.mjs';
 import { snapshotDb } from './lib/db-backup.mjs';
 import {
   extractCitationsFromTranscript,
@@ -851,6 +851,11 @@ function runSessionStartAutoMaintain(db) {
       const lessonsHealed = recoverBuriedLessons(db, mctx);
       if (lessonsHealed > 0) debugLog('DEBUG', 'auto-maintain', `healed ${lessonsHealed} lesson rows buried at importance 0`);
 
+      // Heal deferred_work rows whose closing obs / source prompt was deleted while FK was OFF
+      // (dangling ref foreign_key_check flags). Applies the ON DELETE SET NULL the FK would.
+      const deferredHealed = sweepDeferredWorkOrphans(db, mctx);
+      if (deferredHealed > 0) debugLog('DEBUG', 'auto-maintain', `healed ${deferredHealed} deferred-work rows with dangling references`);
+
       const { decayed, idleMarked } = decayAndMarkIdle(db, mctx);
       if (decayed > 0) debugLog('DEBUG', 'auto-maintain', `decayed ${decayed} stale observations`);
       if (idleMarked > 0) debugLog('DEBUG', 'auto-maintain', `marked ${idleMarked} idle as pending-purge`);

package/install.mjs

@@ -1996,14 +1996,23 @@ async function repair() {
     // repo/TLS-MITM compromise achieved RCE, bypassing the Ed25519 signed-release control that
     // the manual `update` path enforces. Lazy import so a missing/broken hook-update dependency
     // degrades to the manual fallback (fail-closed) rather than to unverified auto-install.
-    let fetchLatestRelease, verifyReleaseAuthenticity;
+    let fetchLatestRelease, verifyReleaseAuthenticity, validateExtractedTarball, isRepairDowngrade, getCurrentVersion;
     try {
-      ({ fetchLatestRelease, verifyReleaseAuthenticity } = await import('./hook-update.mjs'));
+      ({ fetchLatestRelease, verifyReleaseAuthenticity, validateExtractedTarball, isRepairDowngrade, getCurrentVersion } = await import('./hook-update.mjs'));
     } catch (e) {
       throw new Error(`cannot load the verified-update path (${e.message}) — refusing to auto-install unverified code`, { cause: e });
     }
     const rel = await fetchLatestRelease();
     if (!rel || !rel.tarballUrl) throw new Error('could not resolve the latest release (network / rate-limit)');
+    // Rollback guard: refuse to repair BACKWARD onto an older validly-signed release replayed
+    // as "latest" (the only attack signing leaves open). Skipped when the local version is
+    // unreadable — a broken install still needs repair; the signature check below still gates
+    // authenticity either way.
+    let localVersion = null;
+    try { localVersion = getCurrentVersion(); } catch { /* broken install → allow repair */ }
+    if (isRepairDowngrade(rel.version, localVersion)) {
+      throw new Error(`refusing to repair BACKWARD: resolved release v${rel.version} is older than installed v${localVersion} (possible signed-release rollback)`);
+    }
     // URL allow-list mirrors hook-update.downloadAndInstall — only github.com tarball URLs.
     if (!/^https:\/\/(?:api\.)?github\.com\/[a-zA-Z0-9./_-]+$/.test(rel.tarballUrl)) {
       throw new Error(`refusing suspicious tarball URL: ${rel.tarballUrl}`);
@@ -2015,6 +2024,11 @@ async function repair() {
     log('Extracting...');
     execFileSync('tar', ['xzf', tarballPath, '-C', stagingDir, '--strip-components=1'],
       { timeout: 30000, stdio: ['ignore', 'pipe', 'inherit'] });
+    // Defense-in-depth on the extracted tarball (name + version === resolved tag + entry
+    // points) BEFORE the signature check — parity with hook-update.downloadAndInstall. Catches
+    // a wrong-version / truncated / squatter artifact whose package.json doesn't match the tag.
+    const tarballValid = validateExtractedTarball(stagingDir, rel.version);
+    if (!tarballValid.ok) throw new Error(`extracted tarball failed validation: ${tarballValid.reason}`);
     // Verify the Ed25519 signature BEFORE running the downloaded install.mjs. Fail-closed:
     // any tampering / missing-signature / fetch-failure aborts to the manual fallback.
     log('Verifying release signature...');

package/lib/id-routing.mjs

@@ -10,18 +10,19 @@
 
 /**
  * Parse an ID token as it appears in search output or CLI positional args.
- * Accepts: `123`, `#123`, `P#123` / `p123` (prompt), `S#123` / `s123` (session).
+ * Accepts: `123`, `#123`, `P#123` / `p123` (prompt), `S#123` / `s123` (session),
+ * `E#123` / `e123` (event — the canonical event-typed store surfaced as `E#N` by mem_search).
  * @param {unknown} raw
- * @returns {{ source: 'obs'|'session'|'prompt'|null, id: number } | null}
+ * @returns {{ source: 'obs'|'session'|'prompt'|'event'|null, id: number } | null}
  *   source===null means no explicit prefix — caller picks default (typically 'obs').
  */
 export function parseIdToken(raw) {
-  const m = /^([PpSs]?)#?(\d+)$/.exec(String(raw).trim());
+  const m = /^([EePpSs]?)#?(\d+)$/.exec(String(raw).trim());
   if (!m) return null;
   const p = m[1].toUpperCase();
   const id = parseInt(m[2], 10);
   if (!Number.isFinite(id) || id <= 0) return null;
-  const source = p === 'P' ? 'prompt' : p === 'S' ? 'session' : null;
+  const source = p === 'P' ? 'prompt' : p === 'S' ? 'session' : p === 'E' ? 'event' : null;
   return { source, id };
 }
 
@@ -35,11 +36,11 @@ export function parseIdToken(raw) {
  * per-token prefixes. Un-prefixed tokens fall back to `defaultSource`.
  *
  * @param {Array<string|number>} tokens Mixed input — order preserved within each bucket.
- * @param {{explicit?: 'obs'|'session'|'prompt'|null, defaultSource?: 'obs'|'session'|'prompt'}} opts
- * @returns {{bySrc: {obs:number[], session:number[], prompt:number[]}, invalid: string[]}}
+ * @param {{explicit?: 'obs'|'session'|'prompt'|'event'|null, defaultSource?: 'obs'|'session'|'prompt'|'event'}} opts
+ * @returns {{bySrc: {obs:number[], session:number[], prompt:number[], event:number[]}, invalid: string[]}}
  */
 export function bucketIdTokens(tokens, { explicit = null, defaultSource = 'obs' } = {}) {
-  const bySrc = { obs: [], session: [], prompt: [] };
+  const bySrc = { obs: [], session: [], prompt: [], event: [] };
   const invalid = [];
   for (const raw of tokens) {
     if (typeof raw === 'number' && Number.isFinite(raw) && raw > 0) {
@@ -60,11 +61,11 @@ export function bucketIdTokens(tokens, { explicit = null, defaultSource = 'obs'
  *
  * @param {import('better-sqlite3').Database} db
  * @param {number[]} ids Numeric IDs to probe (non-negative ints).
- * @param {Set<'obs'|'session'|'prompt'>} excludeSrcs Sources to skip.
- * @returns {{obs:number[], session:number[], prompt:number[]}}
+ * @param {Set<'obs'|'session'|'prompt'|'event'>} excludeSrcs Sources to skip.
+ * @returns {{obs:number[], session:number[], prompt:number[], event:number[]}}
  */
 export function probeOtherSources(db, ids, excludeSrcs) {
-  const result = { obs: [], session: [], prompt: [] };
+  const result = { obs: [], session: [], prompt: [], event: [] };
   if (!ids || ids.length === 0) return result;
   const placeholders = ids.map(() => '?').join(',');
   try {
@@ -80,6 +81,10 @@ export function probeOtherSources(db, ids, excludeSrcs) {
       const hits = db.prepare(`SELECT id FROM user_prompts WHERE id IN (${placeholders})`).all(...ids);
       result.prompt = hits.map(r => r.id);
     }
+    if (!excludeSrcs.has('event')) {
+      const hits = db.prepare(`SELECT id FROM events WHERE id IN (${placeholders})`).all(...ids);
+      result.event = hits.map(r => r.id);
+    }
   } catch { /* best-effort hint; never block the caller */ }
   return result;
 }

package/lib/maintain-core.mjs

@@ -140,6 +140,30 @@ export function recoverBuriedLessons(db, { projectFilter = '', baseParams = [] }
   `).run(...baseParams).changes;
 }
 
+// Heal deferred_work rows whose closing observation / source prompt was hard-deleted while
+// foreign_keys was OFF. The warm-start fast-path deliberately runs with FK disabled (schema.mjs
+// early migrations require cascade off), so the column's `ON DELETE SET NULL` never fired and a
+// dangling closed_by_obs_id / source_prompt_id survives — exactly what `PRAGMA foreign_key_check`
+// flags. This applies the SET NULL the FK would have. Closure state lives in status/
+// closed_at_epoch, NOT the back-ref, so nulling the id does NOT reopen a done item — it only drops
+// a pointer to a row that no longer exists. NON-DESTRUCTIVE + idempotent (a no-op once no dangling
+// refs remain), so safe to run unconditionally alongside recoverOrphanedChildren. (P3-5)
+export function sweepDeferredWorkOrphans(db, { projectFilter = '', baseParams = [] } = {}) {
+  const obs = db.prepare(`
+    UPDATE deferred_work SET closed_by_obs_id = NULL
+    WHERE closed_by_obs_id IS NOT NULL
+      AND NOT EXISTS (SELECT 1 FROM observations o WHERE o.id = deferred_work.closed_by_obs_id)
+      ${projectFilter}
+  `).run(...baseParams).changes;
+  const prompt = db.prepare(`
+    UPDATE deferred_work SET source_prompt_id = NULL
+    WHERE source_prompt_id IS NOT NULL
+      AND NOT EXISTS (SELECT 1 FROM user_prompts p WHERE p.id = deferred_work.source_prompt_id)
+      ${projectFilter}
+  `).run(...baseParams).changes;
+  return obs + prompt;
+}
+
 export function cleanupBroken(db, { projectFilter, baseParams, opCap = OP_CAP }) {
   const doomed = db.prepare(`
     SELECT id FROM observations

package/lib/search-core.mjs

@@ -24,7 +24,7 @@
 // keys (date=created_at, text=prompt_text, session=content_session_id) so each
 // surface's renderer reads its own field names off a single row shape.
 
-import { sanitizeFtsQuery, relaxFtsQueryToOr, SESS_BM25, DEFAULT_DECAY_HALF_LIFE_MS } from '../utils.mjs';
+import { sanitizeFtsQuery, relaxFtsQueryToOr, SESS_BM25, EVT_BM25, DEFAULT_DECAY_HALF_LIFE_MS } from '../utils.mjs';
 import { cjkPrecisionOk, extractCjkLikePatterns } from '../nlp.mjs';
 import { computeTier } from '../tier.mjs';
 import { countSearchTotal, attachBodyTokens } from '../search-engine.mjs';
@@ -213,6 +213,38 @@ export function searchPromptsFts(db, { query, ftsQuery, project = null, epochFro
     .map((r) => ({ ...r, score: 0 }));
 }
 
+/**
+ * Event FTS search (events table via events_fts) with recency decay + same-project boost —
+ * the mirror of searchSessionsFts for the events source. Events are the CANONICAL store for
+ * event-typed memories (persistHaikuSummary upgrade-deletes the pre-saved observations row and
+ * inserts here), so without this leg the bugfix/feature/decision history is unreachable by
+ * mem_search. Excludes superseded events (superseded_at_epoch); events has no low-signal/noise
+ * column, so no noise gate (parity with searchEvents in lib/activity.mjs). Returns raw rows
+ * { id, event_type, title, body, project, importance, file_paths, created_at_epoch, score }.
+ */
+export function searchEventsFts(db, { ftsQuery, project = null, projectBoost = null, epochFrom = null, epochTo = null, eventType = null, importance = null, perSourceLimit, perSourceOffset = 0 }) {
+  const wheres = ['events_fts MATCH ?', 'e.superseded_at_epoch IS NULL'];
+  const params = [Date.now(), projectBoost, projectBoost, ftsQuery];
+  if (project) { wheres.push('e.project = ?'); params.push(project); }
+  if (epochFrom !== null) { wheres.push('e.created_at_epoch >= ?'); params.push(epochFrom); }
+  if (epochTo !== null) { wheres.push('e.created_at_epoch <= ?'); params.push(epochTo); }
+  // D#76: event_type filter (obs_type maps here) + importance floor (events carry importance).
+  if (eventType) { wheres.push('e.event_type = ?'); params.push(eventType); }
+  if (importance) { wheres.push('COALESCE(e.importance, 1) >= ?'); params.push(importance); }
+  params.push(perSourceLimit, perSourceOffset);
+  return db.prepare(`
+    SELECT e.id, e.event_type, e.title, e.body, e.project, e.importance, e.file_paths, e.created_at_epoch,
+           ${EVT_BM25}
+             * (1.0 + EXP(-0.693 * MAX(0, ? - e.created_at_epoch) / ${DEFAULT_DECAY_HALF_LIFE_MS}.0))
+             * (CASE WHEN ? IS NOT NULL AND e.project = ? THEN 2.0 ELSE 1.0 END) as score
+    FROM events_fts
+    JOIN events e ON events_fts.rowid = e.id
+    WHERE ${wheres.join(' AND ')}
+    ORDER BY score
+    LIMIT ? OFFSET ?
+  `).all(...params);
+}
+
 /**
  * Normalize each source's BM25 scores to [-1, 0] before cross-source merge.
  * Prevents observations (BM25 can reach -40) from systematically outranking
@@ -221,7 +253,7 @@ export function searchPromptsFts(db, { query, ftsQuery, project = null, epochFro
  * -1.0. Mutates `results` in place; callers re-sort afterwards.
  */
 export function normalizeCrossSourceScores(results, sourceKey) {
-  for (const src of ['obs', 'session', 'prompt']) {
+  for (const src of ['obs', 'session', 'prompt', 'event']) {
     const srcResults = results.filter((r) => r[sourceKey] === src && r.score !== null && r.score !== undefined);
     if (srcResults.length < 2) continue;
     const maxAbs = Math.max(...srcResults.map((r) => Math.abs(r.score)));
@@ -292,7 +324,7 @@ export function applyTierFilter(db, results, { tier, sourceKey, currentProject }
 export function finalizeSearchPage(db, results, {
   isDeep, offset, limit, effectiveSource, ftsQuery, orFallbackFired,
   project = null, obsType = null, importance = null, branch = null,
-  epochFrom = null, epochTo = null, includeNoise = false,
+  epochFrom = null, epochTo = null, includeNoise = false, obsTypeScoped = false,
 }) {
   const total = isDeep
     ? results.length
@@ -303,6 +335,7 @@ export function finalizeSearchPage(db, results, {
       args: { project: project || null, obs_type: obsType || null, importance: importance || null, branch: branch || null },
       project: project || null,
       epochFrom, epochTo, includeNoise,
+      obsTypeScoped,   // D#76: count obs + type-filtered events only (skip type-less sessions/prompts)
     }), results.length);
   const page = results.slice(offset, offset + limit);
   attachBodyTokens(db, page);
@@ -342,6 +375,9 @@ export async function coreRunSearchPipeline(ctx, opts) {
     limit, offset, project = null, obsType = null, importance = null, branch = null,
     includeNoise = false, epochFrom = null, epochTo = null, sort = 'relevance', tier = null,
     // ── surface policy (strict behavior-preservation; the two surfaces differ) ──
+    obsTypeScoped = false,             // D#76: obs_type given (no branch/tier) ⇒ scope to obs+events (both carry the type
+                                       //       vocabulary), NOT observations-only. Skips the type-less sessions/prompts legs
+                                       //       and their counts; the events leg filters by event_type = obsType. Both surfaces.
     obsTypeFallback = false,           // A5: list-recent-by-type when 0 matches — MCP true, CLI false (#8217 removed it from CLI)
     crossSourceEpochSortNoFts = false, // A3: epoch-sort the cross-source set when no ftsQuery — MCP true, CLI false
     rerankPolicy = 'mcp',              // A4: re-rank/supersede gate + re-sort condition — 'mcp' | 'cli'
@@ -406,7 +442,11 @@ export async function coreRunSearchPipeline(ctx, opts) {
   }
 
   // ── Sessions (FTS via shared helper; optional recent-listing when no ftsQuery) ──
-  if ((!effectiveSource || effectiveSource === 'sessions') && !isDeep) {
+  // D#74: `!isDeep || escalated` — auto-escalation replaces the obs leg with a deep fuse but must
+  // NOT silently drop the cross-source complement (it did: escalated → isDeep → every leg below
+  // skipped). Explicit deep=true (escalated stays false) still dives obs-only. D#76: obsTypeScoped
+  // skips the type-less sessions/prompts legs (they can't honor an obs_type/event_type filter).
+  if ((!effectiveSource || effectiveSource === 'sessions') && (!isDeep || escalated) && !obsTypeScoped) {
     const pushSessions = () => {
       if (ftsQuery) {
         const rows = searchSessionsFts(db, { ftsQuery, project, projectBoost: project ? null : currentProject, epochFrom, epochTo, perSourceLimit, perSourceOffset });
@@ -431,7 +471,7 @@ export async function coreRunSearchPipeline(ctx, opts) {
   }
 
   // ── Prompts (FTS via shared helper incl. CJK gate; optional recent-listing) ──
-  if ((!effectiveSource || effectiveSource === 'prompts') && !isDeep) {
+  if ((!effectiveSource || effectiveSource === 'prompts') && (!isDeep || escalated) && !obsTypeScoped) {
     const pushPrompts = () => {
       if (ftsQuery) {
         const rows = searchPromptsFts(db, { query, ftsQuery, project, epochFrom, epochTo, perSourceLimit, perSourceOffset });
@@ -457,6 +497,45 @@ export async function coreRunSearchPipeline(ctx, opts) {
     if (tolerateMissingFts) { try { pushPrompts(); } catch { /* prompt FTS may not exist in older DBs */ } } else pushPrompts();
   }
 
+  // ── Events (FTS via shared helper; events are the CANONICAL event-typed store) ──
+  // Runs on auto-escalation too (D#74) and participates in obsTypeScoped (D#76) — events carry the
+  // same type vocabulary as observations, so an obs_type filter maps to e.event_type here.
+  if ((!effectiveSource || effectiveSource === 'events') && (!isDeep || escalated)) {
+    const toIso = (epoch) => (epoch ? new Date(epoch).toISOString() : null);
+    // events has no created_at ISO column (only *_epoch) and no subtitle; body carries the
+    // distilled lesson (persistHaikuSummary writes lesson_learned||narrative here), surfaced
+    // as lesson_learned (obs parity) AND text (attachBodyTokens / CLI JSON body field).
+    const shapeEvent = (r) => ({
+      source: 'event', id: r.id, type: r.event_type, title: r.title,
+      project: r.project, importance: r.importance, files_modified: r.file_paths,
+      created_at_epoch: r.created_at_epoch, created_at: toIso(r.created_at_epoch), date: toIso(r.created_at_epoch),
+      lesson_learned: r.body, text: r.body, score: r.score ?? 0, snippet: '',
+    });
+    const pushEvents = () => {
+      if (ftsQuery) {
+        // D#76: obsType maps to e.event_type (shared vocab); importance filters events too (they carry it).
+        const rows = searchEventsFts(db, { ftsQuery, project, projectBoost: project ? null : currentProject, epochFrom, epochTo, eventType: obsType, importance, perSourceLimit, perSourceOffset });
+        for (const r of rows) results.push(shapeEvent(r));
+      } else if (recentListingNoFts && effectiveSource === 'events') {
+        const params = []; const wheres = ['superseded_at_epoch IS NULL'];
+        if (project) { wheres.push('project = ?'); params.push(project); }
+        if (epochFrom !== null) { wheres.push('created_at_epoch >= ?'); params.push(epochFrom); }
+        if (epochTo !== null) { wheres.push('created_at_epoch <= ?'); params.push(epochTo); }
+        if (obsType) { wheres.push('event_type = ?'); params.push(obsType); }
+        if (importance) { wheres.push('COALESCE(importance, 1) >= ?'); params.push(importance); }
+        params.push(perSourceLimit, perSourceOffset);
+        const rows = db.prepare(`
+          SELECT id, event_type, title, body, project, importance, file_paths, created_at_epoch
+          FROM events WHERE ${wheres.join(' AND ')}
+          ORDER BY created_at_epoch DESC
+          LIMIT ? OFFSET ?
+        `).all(...params);
+        for (const r of rows) results.push(shapeEvent(r));
+      }
+    };
+    if (tolerateMissingFts) { try { pushEvents(); } catch { /* events_fts may not exist in older DBs */ } } else pushEvents();
+  }
+
   // ── Type-list fallback (MCP): obs_type set + 0 matches → list recent of that type ──
   if (obsTypeFallback && results.length === 0 && obsType) {
     const typeWheres = ['COALESCE(compressed_into, 0) = 0', 'superseded_at IS NULL', 'type = ?'];
@@ -518,7 +597,7 @@ export async function coreRunSearchPipeline(ctx, opts) {
   const preFinalizeCount = results.length;
   const { total, page } = finalizeSearchPage(db, results, {
     isDeep, offset, limit, effectiveSource, ftsQuery, orFallbackFired,
-    project, obsType, importance, branch, epochFrom, epochTo, includeNoise,
+    project, obsType, importance, branch, epochFrom, epochTo, includeNoise, obsTypeScoped,
   });
 
   return {

package/lib/timeline-core.mjs

@@ -53,6 +53,18 @@ export function resolveAnchorToken(db, rawAnchor, { project = null } = {}) {
     return { ok: true, anchorId: nearest.id, anchorNote: `(anchored to #${nearest.id}, closest obs to ${srcPrefix}${parsed.id})` };
   }
 
+  // Events are the canonical event-typed store (E#N in mem_search output). They have no
+  // place in the obs-centric before/after window, so — like prompt/session — anchor to the
+  // nearest observation by epoch. Without this explicit branch an E#N token would fall through
+  // to the bare-int obs lookup below and silently resolve to the COLLIDING observation id.
+  if (parsed.source === 'event') {
+    const row = db.prepare('SELECT created_at_epoch FROM events WHERE id = ?').get(parsed.id);
+    if (!row) return { ok: false, error: { code: 'source-not-found', name: 'Event', prefix: 'E#', id: parsed.id } };
+    const nearest = nearestObservation(db, row.created_at_epoch, project);
+    if (!nearest) return { ok: false, error: { code: 'no-obs-near', prefix: 'E#', id: parsed.id } };
+    return { ok: true, anchorId: nearest.id, anchorNote: `(anchored to #${nearest.id}, closest obs to E#${parsed.id})` };
+  }
+
   // Bare "#N" or "N" — observation first. Route compressed obs to its live
   // parent so the window (which filters compressed) isn't shown around a dead
   // record; negative sentinels (-1 dropped, -2 pending purge) have no parent.

package/mem-cli.mjs

@@ -18,7 +18,7 @@ import { selectCompressionCandidates, groupByProjectWeek, compressGroup } from '
 import { buildNotLowSignalSql } from './lib/low-signal-patterns.mjs';
 import {
   cleanupBroken, decayAndMarkIdle, boostAccessed, demotePinned, mergeDuplicates,
-  recoverOrphanedChildren, recoverBuriedLessons,
+  recoverOrphanedChildren, recoverBuriedLessons, sweepDeferredWorkOrphans,
   purgeStale, purgeStalePreview, findDuplicates, maintenanceStats, rebuildVectors, vacuum,
   recoverChildrenOf, hardDeleteCandidateCount,
   OP_CAP, STALE_AGE_MS, PINNED_INJ_THRESHOLD,
@@ -76,7 +76,7 @@ async function cmdSearch(db, args, { llm } = {}) {
     fail(`[mem] Invalid --type "${type}". Valid: ${[...validObsTypes].join(', ')}`);
     return;
   }
-  const source = flags.source || null; // observations|sessions|prompts (null = all)
+  const source = flags.source || null; // observations|sessions|prompts|events (null = all)
   const project = flags.project ? resolveProject(db, flags.project) : null;
   const bounds = parseDateBounds(flags.from, flags.to, flags.since);
   if (!bounds.ok) {
@@ -135,8 +135,8 @@ async function cmdSearch(db, args, { llm } = {}) {
     process.stderr.write('[mem] Note: --rerank requires --deep (it reranks deep-search candidates); ignored\n');
   }
 
-  if (source && !['observations', 'sessions', 'prompts'].includes(source)) {
-    fail(`[mem] Invalid --source "${source}". Use: observations, sessions, prompts`);
+  if (source && !['observations', 'sessions', 'prompts', 'events'].includes(source)) {
+    fail(`[mem] Invalid --source "${source}". Use: observations, sessions, prompts, events`);
     return;
   }
 
@@ -176,9 +176,23 @@ async function cmdSearch(db, args, { llm } = {}) {
   if (deepMode === 'deep' && source && source !== 'observations') {
     process.stderr.write(`[mem] Note: --deep searches observations only; ignoring --source ${source}\n`);
   }
-  const effectiveSource = deepMode === 'deep'
-    ? 'observations'
-    : (source || ((type || tier || minImportance || branch) ? 'observations' : null));
+  // branch/tier are obs-exclusive columns → force observations. --type (obs_type) maps to both
+  // observations.type AND events.event_type, so scope to obs+events and skip the type-less
+  // sessions/prompts legs (D#76). --importance rides the obsTypeScoped path (events carry importance).
+  let effectiveSource;
+  let obsTypeScoped = false;
+  if (deepMode === 'deep') {
+    effectiveSource = 'observations';
+  } else if (source) {
+    effectiveSource = source;
+  } else if (type && !branch && !tier) {
+    effectiveSource = null;
+    obsTypeScoped = true;
+  } else if (minImportance || branch || tier) {
+    effectiveSource = 'observations';
+  } else {
+    effectiveSource = null;
+  }
 
   const res = await coreRunSearchPipeline(
     {
@@ -191,6 +205,7 @@ async function cmdSearch(db, args, { llm } = {}) {
       limit, offset, project: project || null, obsType: type, importance: minImportance,
       branch, includeNoise, epochFrom: dateFrom, epochTo: dateTo, sort, tier,
       // ── CLI surface policy ──
+      obsTypeScoped,                     // D#76: obs_type ⇒ obs+events (skip type-less sessions/prompts)
       obsTypeFallback: false,            // #8217 removed list-by-type fallback from the CLI
       crossSourceEpochSortNoFts: false,  // CLI never reaches cross-source with empty ftsQuery (fails earlier)
       rerankPolicy: 'cli',               // re-rank/supersede on any obs; re-sort gated on cross-source
@@ -244,7 +259,7 @@ async function cmdSearch(db, args, { llm } = {}) {
 
   // "N of M" total when paged < total (paired-path with server.mjs formatSearchOutput, #8198).
   const showTime = sort === 'time';
-  const hasMixed = paged.some(r => r.source === 'session' || r.source === 'prompt');
+  const hasMixed = paged.some(r => r.source === 'session' || r.source === 'prompt' || r.source === 'event');
   // Suppressed when --or was explicit — user already asked for OR, no "fallback" there.
   const fallbackHint = orFallbackFired && !useOr ? ' (relaxed AND→OR)' : '';
 
@@ -290,7 +305,7 @@ async function cmdSearch(db, args, { llm } = {}) {
   const countLabel = total > paged.length ? `${paged.length} of ${total}` : `${paged.length}`;
   // Pluralize on total — "Found 1 of 44 result" reads wrong; the population (44) drives
   // grammatical number, not the page slice (1).
-  out(`[mem] Found ${countLabel} result${total !== 1 ? 's' : ''} for "${query}"${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt)' : ''}`);
+  out(`[mem] Found ${countLabel} result${total !== 1 ? 's' : ''} for "${query}"${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}`);
   // `~Nt` = est. tokens to fetch this row's full body via mem_get (attachBodyTokens, paired with
   // MCP). Conditional so a row that skipped enrichment renders cleanly, not "~undefinedt".
   const tok = r => (r.bodyTokens ? ` ~${r.bodyTokens}t` : '');
@@ -302,6 +317,12 @@ async function cmdSearch(db, args, { llm } = {}) {
     } else if (r.source === 'prompt') {
       const date = fmtDateShort(r.created_at);
       out(`P#${r.id} 💬 ${date}${timeStr} ${truncate(r.prompt_text || '(empty)', 80)}${tok(r)}`);
+    } else if (r.source === 'event') {
+      const date = fmtDateShort(r.created_at);
+      out(`E#${r.id} ${typeIcon(r.type)} ${date}${timeStr} ${truncate(r.title || '(untitled)', 80)}${tok(r)}`);
+      if (r.lesson_learned) {
+        out(`  -> ${truncate(r.lesson_learned, 80)}`);
+      }
     } else {
       const date = fmtDateShort(r.created_at);
       const title = truncate(r.title || r.subtitle || '(untitled)', 80);
@@ -526,12 +547,31 @@ function renderPromptRows(db, ids) {
   return { text: parts.join('\n\n'), count: rows.length };
 }
 
+function renderEventRows(db, ids) {
+  const placeholders = ids.map(() => '?').join(',');
+  const rows = db.prepare(`SELECT * FROM events WHERE id IN (${placeholders}) ORDER BY created_at_epoch ASC`).all(...ids);
+  if (rows.length === 0) return null;
+  const parts = [];
+  for (const r of rows) {
+    // events store the distilled lesson in `body`; only *_epoch is available for the date.
+    const lines = [`E#${r.id} [${r.event_type}] ${r.created_at_epoch ? fmtDateShort(new Date(r.created_at_epoch).toISOString()) : ''}`];
+    if (r.title) lines.push(`Title: ${r.title}`);
+    if (r.body) lines.push(`Body: ${r.body}`);
+    if (r.project) lines.push(`Project: ${r.project}`);
+    if (r.importance !== null && r.importance !== undefined) lines.push(`Importance: ${r.importance}`);
+    if (r.file_paths) lines.push(`Files: ${r.file_paths}`);
+    if (r.git_sha) lines.push(`Git: ${r.git_sha}`);
+    parts.push(lines.join('\n'));
+  }
+  return { text: parts.join('\n\n'), count: rows.length };
+}
+
 function cmdGet(db, args) {
   const { positional, flags } = parseArgs(args);
   const idStr = positional.join(',');
   if (!idStr) {
-    fail('[mem] Usage: claude-mem-lite get <id1,id2,...> [--source obs|session|prompt] [--fields f1,f2,...]\n' +
-         '        IDs accept prefix from search output: #123 (obs), P#123 (prompt), S#123 (session).');
+    fail('[mem] Usage: claude-mem-lite get <id1,id2,...> [--source obs|session|prompt|event] [--fields f1,f2,...]\n' +
+         '        IDs accept prefix from search output: #123 (obs), P#123 (prompt), S#123 (session), E#123 (event).');
     return;
   }
 
@@ -539,18 +579,18 @@ function cmdGet(db, args) {
 
   // Explicit --source overrides any prefix; otherwise each token's prefix routes individually.
   const explicit = flags.source;
-  const validSources = new Set(['obs', 'session', 'prompt']);
+  const validSources = new Set(['obs', 'session', 'prompt', 'event']);
   if (explicit && !validSources.has(explicit)) {
-    fail(`[mem] Invalid --source "${explicit}". Use: obs, session, prompt`);
+    fail(`[mem] Invalid --source "${explicit}". Use: obs, session, prompt, event`);
     return;
   }
 
-  // Shared bucketing with MCP mem_get — single source of truth for P#/S#/# routing (#8050).
+  // Shared bucketing with MCP mem_get — single source of truth for P#/S#/E#/# routing (#8050).
   const { bySrc, invalid: unparseable } = bucketIdTokens(tokens, { explicit, defaultSource: 'obs' });
   if (unparseable.length > 0) {
     process.stderr.write(`[mem] Ignoring unparseable ID token(s): ${unparseable.join(', ')}\n`);
   }
-  if (bySrc.obs.length + bySrc.session.length + bySrc.prompt.length === 0) {
+  if (bySrc.obs.length + bySrc.session.length + bySrc.prompt.length + bySrc.event.length === 0) {
     fail('[mem] No valid IDs provided');
     return;
   }
@@ -585,11 +625,15 @@ function cmdGet(db, args) {
     const s = renderPromptRows(db, bySrc.prompt);
     if (s) { sections.push(s.text); totalFound += s.count; }
   }
+  if (bySrc.event.length > 0) {
+    const s = renderEventRows(db, bySrc.event);
+    if (s) { sections.push(s.text); totalFound += s.count; }
+  }
 
   if (totalFound === 0) {
     // Probe the OTHER sources so the caller can retry with the right prefix.
     const queried = new Set(Object.entries(bySrc).filter(([, v]) => v.length > 0).map(([k]) => k));
-    const allIds = [...bySrc.obs, ...bySrc.session, ...bySrc.prompt];
+    const allIds = [...bySrc.obs, ...bySrc.session, ...bySrc.prompt, ...bySrc.event];
     const probe = probeIdSources(db, allIds, queried);
     const hits = formatProbeHints(probe);
     const hint = hits.length > 0 ? ` Try: ${hits.join('; ')}.` : '';
@@ -1431,10 +1475,10 @@ function cmdDelete(db, args) {
   // delete operates on observations only. Reject P#/S# explicitly so callers aren't
   // surprised by silent NaN filtering when they paste search-output IDs.
   const tokens = idStr.split(',').map(s => s.trim()).filter(Boolean);
-  const nonObs = tokens.filter(t => /^[PpSs]#?\d+$/.test(t));
+  const nonObs = tokens.filter(t => /^[EePpSs]#?\d+$/.test(t));
   if (nonObs.length > 0) {
     fail(`[mem] delete only works on observations. Rejected: ${nonObs.join(', ')}. ` +
-         `Prompts and sessions are append-only — inspect with \`claude-mem-lite get P#N --source prompt\` / \`--source session\`.`);
+         `Prompts, sessions, and events are not deletable here — inspect with \`claude-mem-lite get P#N --source prompt\` / \`--source session\` / \`--source event\`.`);
     return;
   }
   const ids = tokens.map(t => {
@@ -1508,9 +1552,9 @@ function cmdDelete(db, args) {
 function cmdUpdate(db, args) {
   const { positional, flags } = parseArgs(args);
   const raw = positional[0];
-  if (raw && /^[PpSs]#?\d+$/.test(String(raw).trim())) {
+  if (raw && /^[EePpSs]#?\d+$/.test(String(raw).trim())) {
     fail(`[mem] update only works on observations. Rejected: ${raw}. ` +
-         `Prompts and sessions are append-only.`);
+         `Prompts, sessions, and events are not editable here.`);
     return;
   }
   // Strict parseIdToken gate (aligned with cmdDelete): a bare parseInt fallback
@@ -2044,6 +2088,10 @@ function cmdMaintain(db, args) {
       // lesson-bearing rows only; idempotent no-op once none remain.
       const lessonsHealed = recoverBuriedLessons(db, mctx);
       if (lessonsHealed > 0) results.push(`Healed ${lessonsHealed} lesson rows buried at importance 0`);
+      // Heal deferred_work rows whose closing obs / source prompt was hard-deleted while FK was
+      // OFF (dangling ref foreign_key_check flags). Applies the ON DELETE SET NULL the FK would.
+      const deferredHealed = sweepDeferredWorkOrphans(db, mctx);
+      if (deferredHealed > 0) results.push(`Healed ${deferredHealed} deferred-work rows with dangling references`);
     }
 
     if (ops.includes('decay')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mem-lite",
-  "version": "3.43.0",
+  "version": "3.45.0",
   "description": "Persistent long-term memory for Claude Code via MCP — captures coding decisions, bugfixes, and context across sessions. Hybrid FTS5 + TF-IDF search with episode batching. Single SQLite DB, no external services. A lighter, lower-cost alternative to claude-mem (episode batching + a smaller model; cost savings are an internal estimate, not a measured benchmark).",
   "type": "module",
   "packageManager": "npm@10.9.2",

package/schema.mjs

@@ -104,7 +104,15 @@ export const CODE_DIR = join(homedir(), '.claude-mem-lite');
 // previously-uncited obs (see applyCitationDecay). REAL new column, so unlike v38-v40
 // this DOES advance LATEST_MIGRATION_COLUMN (→ observations.last_cited_session_id);
 // existing DBs reach the ALTER because version 40 != 41 falls through the fast-path.
-export const CURRENT_SCHEMA_VERSION = 41;
+// v42 (events_fts self-heal): events_fts was the one FTS table outside ensureFTS's
+// column-aware recreation (its DDL is non-standard — UNINDEXED cols + custom tokenizer +
+// events_fts_* trigger names — so it can't use the generic ensureFTS). Adds a dedicated
+// ensureEventsFTS run in the migration body so a future events column addition self-heals
+// instead of leaving a stale narrow index whose (wider) triggers throw "no column" and
+// silently drop event writes. NO new column, so LATEST_MIGRATION_COLUMN is unchanged — the
+// forced pass alone carries it (same pattern as v35/v36/v38/v39/v40); existing DBs run it
+// because version 41 != 42 falls through the fast-path.
+export const CURRENT_SCHEMA_VERSION = 42;
 
 // Sentinel column for the LATEST migration set. The fast-path uses this to
 // self-heal half-migrated DBs — schema_version bumped but column ALTERs rolled
@@ -555,6 +563,12 @@ export function initSchema(db) {
     END;
   `);
 
+  // v42: column-aware self-heal for events_fts (the one FTS table the generic ensureFTS can't
+  // manage — UNINDEXED cols + custom tokenizer + events_fts_* triggers). The CREATE ... IF NOT
+  // EXISTS above never widens a drifted (older, narrower) events_fts; this drops+recreates it on
+  // column drift and repopulates. No-op on a healthy DB.
+  ensureEventsFTS(db);
+
   // Observation files junction table for normalized file lookups (replaces LIKE scans on files_modified JSON)
   db.exec(`
     CREATE TABLE IF NOT EXISTS observation_files (
@@ -1067,3 +1081,65 @@ export function ensureFTS(db, ftsName, tableName, columns) {
     } catch { /* non-critical — index repopulates lazily on next write */ }
   }
 }
+
+// Column-aware self-heal for events_fts — the events table's FTS index. events_fts is NOT
+// managed by the generic ensureFTS() above because its DDL is non-standard: event_type and
+// project are UNINDEXED, it uses a custom unicode61 tokenizer with '_-' tokenchars, and its
+// triggers are named events_fts_* (not events_*). Routing it through ensureFTS would recreate
+// it WITHOUT the UNINDEXED cols / tokenizer AND install a SECOND, differently-named trigger set
+// (events_*) that double-writes the index. This dedicated guard mirrors ensureFTS's drift
+// detection while preserving the exact events_fts DDL (schema.mjs events block) — closing the
+// F8/P2-4 gap: events_fts was the one FTS table outside self-heal, so a future events column
+// addition would leave a stale narrow index whose (wider) triggers throw "no column" and
+// silently drop event writes. Idempotent: a no-op once the column set matches.
+const EVENTS_FTS_COLUMNS = ['title', 'body', 'event_type', 'project']; // full set (drift check)
+export function ensureEventsFTS(db) {
+  const ftsRow = db.prepare(`SELECT 1 FROM sqlite_master WHERE type='table' AND name='events_fts'`).get();
+  let recreated = false;
+  if (ftsRow) {
+    let existingCols = [];
+    try { existingCols = db.prepare(`PRAGMA table_info(events_fts)`).all().map(c => c.name); } catch { /* unreadable → recreate */ }
+    const drifted = existingCols.length !== EVENTS_FTS_COLUMNS.length || EVENTS_FTS_COLUMNS.some(c => !existingCols.includes(c));
+    if (drifted) {
+      db.exec(`DROP TRIGGER IF EXISTS events_fts_ai`);
+      db.exec(`DROP TRIGGER IF EXISTS events_fts_ad`);
+      db.exec(`DROP TRIGGER IF EXISTS events_fts_au`);
+      db.exec(`DROP TABLE IF EXISTS events_fts`);
+      recreated = true;
+    }
+  }
+  if (!ftsRow || recreated) {
+    db.exec(`
+      CREATE VIRTUAL TABLE IF NOT EXISTS events_fts USING fts5(
+        title, body, event_type UNINDEXED, project UNINDEXED,
+        content='events', content_rowid='id',
+        tokenize="unicode61 remove_diacritics 2 tokenchars '_-'"
+      );
+    `);
+  }
+  // Triggers reinstated from the canonical template (INSERT all 4 columns; AFTER UPDATE OF the
+  // two INDEXED columns only, so non-indexed bumps don't thrash the index). IF NOT EXISTS so an
+  // unchanged definition is a no-op — byte-identical to the events block in initSchema.
+  db.exec(`
+    CREATE TRIGGER IF NOT EXISTS events_fts_ai AFTER INSERT ON events BEGIN
+      INSERT INTO events_fts(rowid, title, body, event_type, project)
+      VALUES (new.id, COALESCE(new.title,''), COALESCE(new.body,''), new.event_type, new.project);
+    END;
+    CREATE TRIGGER IF NOT EXISTS events_fts_ad AFTER DELETE ON events BEGIN
+      INSERT INTO events_fts(events_fts, rowid, title, body, event_type, project)
+      VALUES ('delete', old.id, COALESCE(old.title,''), COALESCE(old.body,''), old.event_type, old.project);
+    END;
+    CREATE TRIGGER IF NOT EXISTS events_fts_au AFTER UPDATE OF title, body ON events BEGIN
+      INSERT INTO events_fts(events_fts, rowid, title, body, event_type, project)
+      VALUES ('delete', old.id, COALESCE(old.title,''), COALESCE(old.body,''), old.event_type, old.project);
+      INSERT INTO events_fts(rowid, title, body, event_type, project)
+      VALUES (new.id, COALESCE(new.title,''), COALESCE(new.body,''), new.event_type, new.project);
+    END;
+  `);
+  if (recreated) {
+    try {
+      const cnt = db.prepare(`SELECT COUNT(*) AS c FROM events`).get();
+      if (cnt.c > 0) db.exec(`INSERT INTO events_fts(events_fts) VALUES('rebuild')`);
+    } catch { /* non-critical — index repopulates lazily on next write */ }
+  }
+}

package/scoring-sql.mjs

@@ -51,6 +51,10 @@ export const OBS_BM25 = 'bm25(observations_fts, 10, 5, 5, 3, 3, 2, 8, 5)';
 /** session_summaries_fts BM25 weights: request=5, investigated=3, learned=3, completed=3, next_steps=2, notes=1, remaining_items=1 */
 export const SESS_BM25 = 'bm25(session_summaries_fts, 5, 3, 3, 3, 2, 1, 1)';
 
+/** events_fts BM25 weights: title=5, body=2 (event_type/project are UNINDEXED — weight irrelevant).
+ *  Title-weighted like OBS/SESS so a title hit outranks a body-only hit. */
+export const EVT_BM25 = 'bm25(events_fts, 5, 2)';
+
 /** FTS5 columns for observations (must match BM25 weight order) */
 export const OBS_FTS_COLUMNS = ['title', 'subtitle', 'narrative', 'text', 'facts', 'concepts', 'lesson_learned', 'search_aliases'];
 

package/search-engine.mjs

@@ -167,6 +167,28 @@ export function countPromptFtsMatches(db, { ftsQuery, project = null, epochFrom
   } catch { return 0; }
 }
 
+export function countEventFtsMatches(db, { ftsQuery, project = null, epochFrom = null, epochTo = null, eventType = null, importance = null }) {
+  if (!ftsQuery) return 0;
+  try {
+    const wheres = ['events_fts MATCH ?', 'e.superseded_at_epoch IS NULL'];
+    const params = [ftsQuery];
+    if (project) { wheres.push('e.project = ?'); params.push(project); }
+    if (epochFrom) { wheres.push('e.created_at_epoch >= ?'); params.push(epochFrom); }
+    if (epochTo) { wheres.push('e.created_at_epoch <= ?'); params.push(epochTo); }
+    // D#76: keep the count in lockstep with searchEventsFts's event_type/importance filters,
+    // else the "N of M" population diverges from the rows actually shown.
+    if (eventType) { wheres.push('e.event_type = ?'); params.push(eventType); }
+    if (importance) { wheres.push('COALESCE(e.importance, 1) >= ?'); params.push(importance); }
+    const row = db.prepare(`
+      SELECT COUNT(*) as c
+      FROM events_fts
+      JOIN events e ON events_fts.rowid = e.id
+      WHERE ${wheres.join(' AND ')}
+    `).get(...params);
+    return row?.c ?? 0;
+  } catch { return 0; }
+}
+
 /**
  * Sum true match counts across the sources that contribute to a cross-source (or
  * source-restricted) search. `obsFtsQuery` lets callers pass the OR-relaxed query
@@ -176,17 +198,23 @@ export function countPromptFtsMatches(db, { ftsQuery, project = null, epochFrom
 export function countSearchTotal(db, {
   effectiveSource = null, ftsQuery, obsFtsQuery = null,
   args = {}, project = null, epochFrom = null, epochTo = null, includeNoise = false,
+  obsTypeScoped = false,
 }) {
   let total = 0;
   if (!effectiveSource || effectiveSource === 'observations') {
     total += countObsFtsMatches(db, { ftsQuery: obsFtsQuery || ftsQuery, args, epochFrom, epochTo, includeNoise });
   }
-  if (!effectiveSource || effectiveSource === 'sessions') {
+  // D#76: obsTypeScoped (obs_type given, no branch/tier) counts obs + type-filtered events only —
+  // sessions/prompts have no type column, so they are excluded from both the results and the count.
+  if (!obsTypeScoped && (!effectiveSource || effectiveSource === 'sessions')) {
     total += countSessionFtsMatches(db, { ftsQuery, project, epochFrom, epochTo });
   }
-  if (!effectiveSource || effectiveSource === 'prompts') {
+  if (!obsTypeScoped && (!effectiveSource || effectiveSource === 'prompts')) {
     total += countPromptFtsMatches(db, { ftsQuery, project, epochFrom, epochTo });
   }
+  if (!effectiveSource || effectiveSource === 'events') {
+    total += countEventFtsMatches(db, { ftsQuery, project, epochFrom, epochTo, eventType: args.obs_type || null, importance: args.importance || null });
+  }
   return total;
 }
 
@@ -235,6 +263,8 @@ export function attachBodyTokens(db, results) {
       parts = [r.title, r.subtitle, r.lesson_learned, row.narrative, row.facts, row.text];
     } else if (src === 'session') {
       parts = [r.request, r.completed, r.working_on];
+    } else if (src === 'event') {
+      parts = [r.title, r.lesson_learned];   // events carry title + body(=lesson_learned) on the row
     } else {
       parts = [r.text, r.prompt_text];
     }

package/server.mjs

@@ -17,7 +17,7 @@ import { resolveAnchorToken, formatAnchorError, resolveQueryAnchor, fetchRecentT
 import { buildSearchFtsQuery, parseDateBounds, parseDuration, coreRunSearchPipeline } from './lib/search-core.mjs';
 import {
   cleanupBroken, decayAndMarkIdle, boostAccessed, demotePinned, mergeDuplicates,
-  recoverOrphanedChildren, recoverBuriedLessons,
+  recoverOrphanedChildren, recoverBuriedLessons, sweepDeferredWorkOrphans,
   purgeStale, purgeStalePreview, findDuplicates, maintenanceStats, rebuildVectors, vacuum,
   recoverChildrenOf, hardDeleteCandidateCount,
   OP_CAP, STALE_AGE_MS,
@@ -218,7 +218,7 @@ function formatSearchOutput(paginatedResults, args, ftsQuery, totalCount, orFall
   const countLabel = totalCount > paginatedResults.length
     ? `${paginatedResults.length} of ${totalCount}`
     : `${paginatedResults.length}`;
-  const hasMixed = paginatedResults.some(r => r.source === 'session' || r.source === 'prompt');
+  const hasMixed = paginatedResults.some(r => r.source === 'session' || r.source === 'prompt' || r.source === 'event');
   // P2-6: empty/omitted query falls through to a "listing recent" path — label it explicitly
   // so callers don't mistake BM25-less results for relevance-ranked ones.
   const qLabel = args.query ? ` for "${args.query}"` : ' (no query — listing recent)';
@@ -226,7 +226,7 @@ function formatSearchOutput(paginatedResults, args, ftsQuery, totalCount, orFall
   // query actually matched only a subset of the terms. Suppressed when the caller
   // explicitly requested OR semantics — there's no "fallback" in that path.
   const fallbackHint = orFallbackFired && !args.or ? ' (relaxed AND→OR)' : '';
-  lines.push(`Found ${countLabel} result(s)${qLabel}${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt)' : ''}\n`);
+  lines.push(`Found ${countLabel} result(s)${qLabel}${fallbackHint}:${hasMixed ? ' (# observation, S# session, P# prompt, E# event)' : ''}\n`);
 
   // `~Nt` = estimated tokens to fetch this row's full body via mem_get (attachBodyTokens).
   // Conditional so a result that skipped enrichment renders cleanly, not "~undefinedt".
@@ -241,6 +241,8 @@ function formatSearchOutput(paginatedResults, args, ftsQuery, totalCount, orFall
       lines.push(`S#${r.id} 📋 ${truncate(r.request || r.completed || '(no summary)')} | ${r.project} | ${fmtDate(r.date)}${tok(r)}`);
     } else if (r.source === 'prompt') {
       lines.push(`P#${r.id} 💬 ${truncate(r.text)} | ${fmtDate(r.date)}${tok(r)}`);
+    } else if (r.source === 'event') {
+      lines.push(`E#${r.id} ${typeIcon(r.type)} [${r.type}] ${truncate(r.title || '(untitled)')} | ${r.project} | ${fmtDate(r.date)}${tok(r)}`);
     }
   }
 
@@ -287,15 +289,26 @@ async function runSearchPipeline(db, args, { llm, rerankLlm } = {}) {
     return { ...formatSearchOutput([], args, ftsQuery, 0), escalated: false, results: [], total: 0, variants: null };
   }
 
-  // obs_type/importance/branch/tier ⇒ observations-only; deep is observations-only too
-  // (deepSearch fuses hybrid-obs lists). args.type is the source filter
-  // (observations|sessions|prompts). Forcing obs-only for the obs-exclusive fields
-  // matches the CLI (mem-cli.mjs:177): session/prompt tables have no importance/branch/tier
-  // column, so without the force those legs return UNFILTERED and leak rows that can't be
-  // scoped to the filter (branch/importance/tier previously leaked cross-source on MCP).
-  const effectiveType = deepMode === 'deep'
-    ? 'observations'
-    : (args.type || ((args.obs_type || args.importance || args.branch || args.tier) ? 'observations' : undefined));
+  // Source scoping. deep is observations-only (deepSearch fuses hybrid-obs lists). branch/tier are
+  // obs-EXCLUSIVE columns (sessions/prompts/events lack them) → force observations, else those legs
+  // return UNFILTERED and leak rows that can't be scoped (the pre-fix cross-source branch/tier leak).
+  // obs_type is DIFFERENT: events carry the same type vocabulary (events.event_type), so an obs_type
+  // filter maps to obs + events both — scope to those two and skip the type-less sessions/prompts
+  // legs (D#76). importance filters obs and events (both carry it), so it rides the obsTypeScoped path.
+  let effectiveType;
+  let obsTypeScoped = false;
+  if (deepMode === 'deep') {
+    effectiveType = 'observations';
+  } else if (args.type) {
+    effectiveType = args.type;
+  } else if (args.obs_type && !args.branch && !args.tier) {
+    effectiveType = undefined;   // cross-source gate open; obsTypeScoped narrows it to obs+events
+    obsTypeScoped = true;
+  } else if (args.importance || args.branch || args.tier) {
+    effectiveType = 'observations';
+  } else {
+    effectiveType = undefined;
+  }
 
   const r = await coreRunSearchPipeline(
     {
@@ -310,6 +323,7 @@ async function runSearchPipeline(db, args, { llm, rerankLlm } = {}) {
       includeNoise: args.include_noise === true, epochFrom, epochTo,
       sort: args.sort || 'relevance', tier: args.tier ?? null,
       // ── MCP surface policy ──
+      obsTypeScoped,                     // D#76: obs_type ⇒ obs+events (skip type-less sessions/prompts)
       obsTypeFallback: true,             // list-recent-by-type when 0 matches
       crossSourceEpochSortNoFts: true,   // epoch-sort cross-source with no ftsQuery
       rerankPolicy: 'mcp',               // (ftsQuery||isDeep) gate; re-rank/re-sort on ftsQuery&&!reranked
@@ -495,9 +509,9 @@ server.registerTool(
     const { bySrc, invalid } = bucketIdTokens(args.ids, { explicit: args.source || null, defaultSource: 'obs' });
     if (invalid.length > 0) {
       // Should not happen — schema regex already rejected bad tokens — but guard defensively.
-      return { content: [{ type: 'text', text: `Invalid ID token(s): ${invalid.join(', ')}. Expected N, #N, P#N, or S#N.` }] };
+      return { content: [{ type: 'text', text: `Invalid ID token(s): ${invalid.join(', ')}. Expected N, #N, P#N, S#N, or E#N.` }] };
     }
-    const totalRequested = bySrc.obs.length + bySrc.session.length + bySrc.prompt.length;
+    const totalRequested = bySrc.obs.length + bySrc.session.length + bySrc.prompt.length + bySrc.event.length;
     if (totalRequested === 0) {
       return { content: [{ type: 'text', text: 'No valid IDs provided.' }] };
     }
@@ -522,7 +536,7 @@ server.registerTool(
 
     // Per-source fetchers — each returns { rows, foundIds:Set, prefix }.
     const sections = [];
-    const foundBySource = { obs: new Set(), session: new Set(), prompt: new Set() };
+    const foundBySource = { obs: new Set(), session: new Set(), prompt: new Set(), event: new Set() };
 
     if (bySrc.obs.length > 0) {
       const ph = bySrc.obs.map(() => '?').join(',');
@@ -581,17 +595,37 @@ server.registerTool(
       }
     }
 
-    const totalFound = foundBySource.obs.size + foundBySource.session.size + foundBySource.prompt.size;
+    if (bySrc.event.length > 0) {
+      const ph = bySrc.event.map(() => '?').join(',');
+      const rows = db.prepare(`SELECT * FROM events WHERE id IN (${ph}) ORDER BY created_at_epoch ASC`).all(...bySrc.event);
+      // events carry the distilled lesson in `body` (persistHaikuSummary writes lesson_learned||narrative).
+      // No created_at ISO column (only *_epoch) — render the epoch as an ISO string for a scannable date.
+      for (const row of rows) {
+        foundBySource.event.add(row.id);
+        const lines = [`── E#${row.id} [${row.event_type}] ──`];
+        if (row.title) lines.push(`title: ${row.title}`);
+        if (row.body) lines.push(`body: ${row.body.length > 500 ? row.body.slice(0, 500) + '…' : row.body}`);
+        if (row.project) lines.push(`project: ${row.project}`);
+        if (row.importance !== null && row.importance !== undefined) lines.push(`importance: ${row.importance}`);
+        if (row.file_paths) lines.push(`file_paths: ${row.file_paths}`);
+        if (row.git_sha) lines.push(`git_sha: ${row.git_sha}`);
+        if (row.created_at_epoch) lines.push(`created_at: ${new Date(row.created_at_epoch).toISOString()}`);
+        sections.push(lines.join('\n'));
+      }
+    }
+
+    const totalFound = foundBySource.obs.size + foundBySource.session.size + foundBySource.prompt.size + foundBySource.event.size;
 
     if (totalFound === 0) {
       // Probe other sources so callers can retry with the right prefix/source override.
       const queried = new Set(Object.entries(bySrc).filter(([, v]) => v.length > 0).map(([k]) => k));
-      const allNumericIds = [...bySrc.obs, ...bySrc.session, ...bySrc.prompt];
+      const allNumericIds = [...bySrc.obs, ...bySrc.session, ...bySrc.prompt, ...bySrc.event];
       const probe = probeIdSources(db, allNumericIds, queried);
       const hints = [];
       if (probe.obs.length > 0)     hints.push(`#${probe.obs.join(', #')} (obs — use source='obs' or bare #N)`);
       if (probe.session.length > 0) hints.push(`S#${probe.session.join(', S#')} (session — use source='session' or S#N)`);
       if (probe.prompt.length > 0)  hints.push(`P#${probe.prompt.join(', P#')} (prompt — use source='prompt' or P#N)`);
+      if (probe.event.length > 0)   hints.push(`E#${probe.event.join(', E#')} (event — use source='event' or E#N)`);
       const hint = hints.length > 0 ? ` Try: ${hints.join('; ')}.` : '';
       const queriedList = [...queried].join(', ');
       const msg = `No records found in source(s) [${queriedList}] for the given ID(s).${hint}`;
@@ -605,6 +639,7 @@ server.registerTool(
     missingHints.push(...miss(bySrc.obs, foundBySource.obs, '#'));
     missingHints.push(...miss(bySrc.session, foundBySource.session, 'S#'));
     missingHints.push(...miss(bySrc.prompt, foundBySource.prompt, 'P#'));
+    missingHints.push(...miss(bySrc.event, foundBySource.event, 'E#'));
 
     const parts = [];
     if (fieldsNote) parts.push(fieldsNote);
@@ -1158,6 +1193,10 @@ server.registerTool(
           // lesson-bearing rows only; idempotent no-op once none remain.
           const lessonsHealed = recoverBuriedLessons(db, mctx);
           if (lessonsHealed > 0) results.push(`Healed ${lessonsHealed} lesson rows buried at importance 0`);
+          // Heal deferred_work rows whose closing obs / source prompt was deleted while FK was
+          // OFF (dangling ref foreign_key_check flags). Applies the ON DELETE SET NULL the FK would.
+          const deferredHealed = sweepDeferredWorkOrphans(db, mctx);
+          if (deferredHealed > 0) results.push(`Healed ${deferredHealed} deferred-work rows with dangling references`);
         }
 
         if (ops.includes('decay')) {

package/tool-schemas.mjs

@@ -75,12 +75,12 @@ const coerceMixedIdTokens = z.preprocess(
     }
     return v;
   },
-  z.array(z.string().regex(/^[PpSs]?#?\d+$/, 'Expected N, #N, P#N, or S#N')).min(1).max(20)
+  z.array(z.string().regex(/^[EePpSs]?#?\d+$/, 'Expected N, #N, P#N, S#N, or E#N')).min(1).max(20)
 );
 
 export const memSearchSchema = {
   query: z.string().optional().describe('Search query (FTS5 syntax supported)'),
-  type: z.enum(['observations', 'sessions', 'prompts']).optional().describe('Limit to one table'),
+  type: z.enum(['observations', 'sessions', 'prompts', 'events']).optional().describe('Limit to one source table (default: all). events = the canonical bugfix/feature/decision/lesson history (auto-captured event-typed memories)'),
   obs_type: OBS_TYPE_ENUM.optional().describe('Filter observation type'),
   project: z.string().optional().describe('Filter by project name'),
   date_from: z.string().optional().describe('Start date (ISO 8601 or YYYY-MM-DD)'),
@@ -120,12 +120,12 @@ const coerceAnchor = z.preprocess(
   },
   z.union([
     z.number().int(),
-    z.string().regex(/^[PpSs]?#?\d+$/, 'Expected N, #N, P#N, or S#N'),
+    z.string().regex(/^[EePpSs]?#?\d+$/, 'Expected N, #N, P#N, S#N, or E#N'),
   ])
 );
 
 export const memTimelineSchema = {
-  anchor: coerceAnchor.optional().describe('Anchor as observation ID (int) or prefixed token string: "#123", "P#123" (prompt → nearest obs), "S#123" (session → nearest obs). Takes precedence over query.'),
+  anchor: coerceAnchor.optional().describe('Anchor as observation ID (int) or prefixed token string: "#123", "P#123" (prompt → nearest obs), "S#123" (session → nearest obs), "E#123" (event → nearest obs). Takes precedence over query.'),
   query: z.string().optional().describe('FTS5 query to auto-find anchor. Ignored when anchor is also given; use one or the other.'),
   before: coerceInt.pipe(z.number().int().min(0).max(50)).optional().describe('Items before anchor (default 5)'),
   after: coerceInt.pipe(z.number().int().min(0).max(50)).optional().describe('Items after anchor (default 5)'),
@@ -136,8 +136,8 @@ export const memGetSchema = {
   // Accepts mixed tokens so pasted search results work verbatim: [1], [1, "P#2"], "1,P#2,S#3",
   // or the JSON-stringified form ["1","P#2"]. Each token's prefix routes to its source bucket
   // in server.mjs via lib/id-routing.bucketIdTokens. An explicit `source` override still wins.
-  ids: coerceMixedIdTokens.describe('Mixed observation/prompt/session IDs — accepts N, #N, P#N, S#N; comma-strings and JSON arrays also coerced'),
-  source: z.enum(['obs', 'session', 'prompt']).optional().describe('Force all IDs to this source (overrides per-token prefixes). Omit to let P#/S#/# prefixes route individually.'),
+  ids: coerceMixedIdTokens.describe('Mixed observation/prompt/session/event IDs — accepts N, #N, P#N, S#N, E#N; comma-strings and JSON arrays also coerced'),
+  source: z.enum(['obs', 'session', 'prompt', 'event']).optional().describe('Force all IDs to this source (overrides per-token prefixes). Omit to let P#/S#/E#/# prefixes route individually.'),
   fields: coerceStringArray.optional().describe('Specific fields to return (default: all; validated against obs schema — session/prompt sources ignore this filter)'),
 };
 
@@ -355,7 +355,8 @@ export const tools = [
   {
     name: 'mem_search',
     description:
-      'Full-text search across observations, sessions, and user prompts (FTS5, BM25-ranked).\n' +
+      'Full-text search across observations, sessions, prompts, and events — the canonical\n' +
+      'bugfix/feature/decision/lesson history (FTS5, BM25-ranked).\n' +
       '\n' +
       'DO NOT use when:\n' +
       '  - The SessionStart context or hook-injected memory already shows #NN entries that answer the question\n' +
@@ -363,9 +364,8 @@ export const tools = [
       '  - You want everything about a specific file (use mem_recall — cheaper and file-scoped)\n' +
       '\n' +
       'USE when:\n' +
-      '  - Investigating a concrete error keyword with obs_type="bugfix"\n' +
+      '  - Investigating an error keyword with obs_type="bugfix" (matches observations AND events)\n' +
       '  - Looking for prior art on a module/feature before refactoring\n' +
-      '  - User asks "have we seen this before" or references something not in visible context\n' +
       '  - A normal search missed — weak results auto-escalate to deep (set deep=false to opt out)\n' +
       '\n' +
       'Equivalent CLI: ' + CLI_INVOKE + ' search "<query>" [--type bugfix] [--deep]',

package/utils.mjs

@@ -9,7 +9,7 @@ import { buildLowSignalRegex } from './lib/low-signal-patterns.mjs';
 // ─── Re-exports from extracted modules ──────────────────────────────────────
 // Backward compatibility: all consumers import from utils.mjs
 
-export { DECAY_HALF_LIFE_BY_TYPE, DEFAULT_DECAY_HALF_LIFE_MS, OBS_BM25, SESS_BM25, TYPE_DECAY_CASE, TYPE_QUALITY_CASE, OBS_FTS_COLUMNS, notLowSignalTitleClause, noisePenaltyClause } from './scoring-sql.mjs';
+export { DECAY_HALF_LIFE_BY_TYPE, DEFAULT_DECAY_HALF_LIFE_MS, OBS_BM25, SESS_BM25, EVT_BM25, TYPE_DECAY_CASE, TYPE_QUALITY_CASE, OBS_FTS_COLUMNS, notLowSignalTitleClause, noisePenaltyClause } from './scoring-sql.mjs';
 export { cjkBigrams, extractCjkSynonymTokens, extractCjkKeywords, extractCjkLikePatterns, SYNONYM_MAP, expandToken, sanitizeFtsQuery, relaxFtsQueryToOr, FTS_STOP_WORDS, CJK_COMPOUNDS } from './nlp.mjs';
 export { resolveProject, _resetProjectCache } from './project-utils.mjs';
 export { scrubSecrets, SECRET_PATTERNS } from './secret-scrub.mjs';
@@ -323,9 +323,17 @@ export function parseJsonFromLLM(text) {
   // First balanced object — survives unfenced output wrapped in brace-containing prose.
   const balanced = firstBalancedJsonObject(text);
   if (balanced) try { return JSON.parse(balanced); } catch {}
-  // Last-resort greedy span (handles a payload that isn't the FIRST balanced object).
-  const obj = text.match(/\{[\s\S]*\}/);
-  if (obj) try { return JSON.parse(obj[0]); } catch {}
+  // Last-resort span from the first `{` to the last `}` — handles a payload that isn't the
+  // FIRST balanced object. Resolved via index scan (O(n)) rather than the greedy
+  // /\{[\s\S]*\}/, which backtracks O(n²) across k unclosed opening braces (a synthetic
+  // "{{{…" with no close made the regex O(n²); LLM outputs are bounded so it wasn't
+  // exploitable — defense in depth). Behaviorally identical: the greedy match anchors on the
+  // first `{` that has any `}` after it and, being greedy, ends at the last `}`.
+  const firstBrace = text.indexOf('{');
+  const lastBrace = text.lastIndexOf('}');
+  if (firstBrace !== -1 && lastBrace > firstBrace) {
+    try { return JSON.parse(text.slice(firstBrace, lastBrace + 1)); } catch {}
+  }
   return null;
 }
 
@@ -456,6 +464,3 @@ export function getCurrentBranch() {
   _branchCacheTime = now;
   return _cachedBranch;
 }
-
-/** Reset cached branch (for testing or after git checkout) */
-export function _resetBranchCache() { _cachedBranch = undefined; _branchCacheTime = 0; }