chainlesschain 0.162.149 → 0.162.150

package/src/lib/agent-team/team-runner.js

@@ -217,9 +217,10 @@ export class TeamRunner {
         mailbox: this.mailbox,
         budget: this.budget,
       });
-      this.registry.complete(key, { holder, result });
-      // Fold usage/cost into the team budget. `--exec` shell tasks carry no
-      // usage → only the task-count / wall-clock dimensions move.
+      const done = this.registry.complete(key, { holder, result });
+      // Fold usage/cost into the team budget regardless — the task DID execute
+      // and consumed resources. `--exec` shell tasks carry no usage → only the
+      // task-count / wall-clock dimensions move.
       if (this.budget) {
         this.budget.record(
           {
@@ -230,12 +231,27 @@ export class TeamRunner {
           this._now(),
         );
       }
-      this._setState(holder, "completed-task");
-      this._emit("task:completed", {
-        key,
-        holder,
-        ms: this._now() - startedAt,
-      });
+      if (done.ok) {
+        this._setState(holder, "completed-task");
+        this._emit("task:completed", {
+          key,
+          holder,
+          ms: this._now() - startedAt,
+        });
+      } else {
+        // The registry REJECTED the completion — the lease expired mid-run (the
+        // task outran its TTL without renewing), so a peer may already own it.
+        // Reporting `task:completed` + bumping the completed counter here would
+        // be a phantom success (the registry has no record of it, and the task
+        // will be reclaimed and re-run). Surface the discard honestly instead so
+        // the event stream and per-teammate stats stay truthful.
+        this._emit("task:completion-discarded", {
+          key,
+          holder,
+          reason: done.reason,
+          ms: this._now() - startedAt,
+        });
+      }
     } catch (err) {
       // A failed task still consumed a task-count slot (and any wall-clock) — fold
       // it so a doomed retry loop can't dodge the budget.

package/src/lib/agent-team/team-worktree.js

@@ -96,6 +96,24 @@ export class TeamWorktreeCoordinator {
   makeRunTask({ runInWorktree = null } = {}) {
     return async ({ key, task, holder }) => {
       const branch = this.branchFor(key);
+      // A retry (the prior attempt failed and TaskLeaseRegistry re-queued the
+      // task) would collide with its own leftover worktree: createWorktree
+      // derives a DETERMINISTIC path from the branch and throws "Worktree
+      // already exists" (and `worktree add -b` rejects the existing branch), so
+      // the retry can never recover — it just re-fails on the collision instead
+      // of the real task. Tear down the prior attempt's worktree + branch first
+      // so a retry starts clean.
+      const prior = this._created.get(key);
+      if (prior) {
+        try {
+          _deps.removeWorktree(this.repoDir, prior.path, {
+            deleteBranch: true,
+          });
+        } catch {
+          /* best-effort — a real problem will resurface in createWorktree */
+        }
+        this._created.delete(key);
+      }
       const { path: worktreePath } = _deps.createWorktree(this.repoDir, branch);
       this._created.set(key, { branch, path: worktreePath, committed: false });
       if (typeof runInWorktree === "function") {
@@ -157,20 +175,34 @@ export class TeamWorktreeCoordinator {
       const conflicts = preview?.conflicts || [];
       let merged = false;
       if (clean && merge) {
+        // mergeWorktree does NOT throw on a failed merge — it catches internally
+        // and RETURNS {success:false, conflicts?, message} (a conflict the clean
+        // preview didn't predict, or any non-conflict git failure). The old
+        // try/catch was dead for that path and set merged:true unconditionally,
+        // reporting a real merge failure as success with empty conflicts. Inspect
+        // the return value. (The try still catches assertSafeGitRef, the only
+        // throw path — a malformed branch ref.)
+        let mergeResult;
         try {
-          _deps.mergeWorktree(this.repoDir, info.branch, {
+          mergeResult = _deps.mergeWorktree(this.repoDir, info.branch, {
             message: `Merge team task ${key}`,
           });
-          merged = true;
         } catch (err) {
+          mergeResult = { success: false, message: err.message };
+        }
+        if (mergeResult?.success === true) {
+          merged = true;
+        } else {
           results.push({
             key,
             branch: info.branch,
             committed: true,
             clean: false,
             merged: false,
-            conflicts,
-            error: `merge failed: ${err.message}`,
+            conflicts: mergeResult?.conflicts?.length
+              ? mergeResult.conflicts
+              : conflicts,
+            error: `merge failed: ${mergeResult?.message || "unknown error"}`,
           });
           continue;
         }

package/src/lib/async-hook-supervisor.cjs

@@ -23,9 +23,10 @@
  *     flight — a rapid PostToolUse hook can't stack N copies of itself;
  *   - a maxConcurrent cap — overflow is DROPPED with a recorded skip, never
  *     queued unbounded;
- *   - a per-hook timeout that kills the child;
- *   - reaping of every child on stopAll() / process 'exit', so a session never
- *     leaves an orphan hook process.
+ *   - a per-hook timeout that TREE-kills the child (shell + the real command it
+ *     spawned — a bare child.kill would orphan the grandchild);
+ *   - tree-reaping of every child on stopAll() / process 'exit', so a session
+ *     never leaves an orphan hook process.
  *
  * `_deps.spawn` / `_deps.now` are injected so the whole supervisor is unit-
  * testable with fake child processes (no real shell).
@@ -37,6 +38,12 @@ const { tryParseDecision } = require("./hook-runner.cjs");
 const DEFAULT_TIMEOUT_MS = 60000;
 const MAX_TIMEOUT_MS = 600000;
 const DEFAULT_MAX_CONCURRENT = 4;
+// Ring cap on undrained records (parity with PluginMonitorSupervisor's
+// OUTPUT_RING): drainResults()/drainRewakes() normally clear each turn, but a
+// stalled/absent drain over a high-frequency hook would otherwise grow these
+// arrays without bound. Keep only the most recent RESULT_RING; older records
+// are dropped oldest-first.
+const RESULT_RING = 500;
 
 class AsyncHookSupervisor {
   constructor(opts = {}) {
@@ -46,20 +53,87 @@ class AsyncHookSupervisor {
         : DEFAULT_MAX_CONCURRENT;
     this._deps = {
       spawn: opts.spawn || cpDefault.spawn,
+      spawnSync: opts.spawnSync || cpDefault.spawnSync,
       now: opts.now || (() => Date.now()),
     };
     this._running = new Map(); // key -> { child, timer }
     this._results = []; // completed records awaiting drainResults()
     this._rewakes = []; // failed asyncRewake records awaiting drainRewakes()
     this._stopped = false;
+    // The exit reaper is installed LAZILY (on first spawn), not in the ctor:
+    // a supervisor that never dispatches a hook (or the many built in tests)
+    // must not leave a permanent `process.once('exit')` listener behind —
+    // that accumulates across sessions/instances into a MaxListenersExceeded
+    // leak. Mirrors PluginMonitorSupervisor._installExitHook.
     this._exitHook = () => this.stopAll();
-    process.once("exit", this._exitHook);
+    this._exitHookInstalled = false;
   }
 
   _key(hook) {
     return `${hook.event || ""}::${hook.command}`;
   }
 
+  /**
+   * Kill a hook child's WHOLE process tree. Hooks run with `shell: true`, so the
+   * real command is a grandchild of the shell — a plain `child.kill()` only
+   * signals the shell (POSIX: reparents + keeps the command running; Windows:
+   * killing cmd.exe never touches its children), orphaning the actual hook
+   * process. POSIX: the child is spawned detached (its own group), so a negative
+   * pid signals the whole group. Windows: `taskkill /T` walks the tree. Both are
+   * SYNCHRONOUS (spawnSync / process.kill) so this is safe inside stopAll() and
+   * the process 'exit' reaper, where async work would be cut off. A child with no
+   * real pid (the unit-test fakes) falls back to its own `.kill()`.
+   */
+  _killChildTree(child, signal = "SIGTERM") {
+    if (!child) return;
+    const pid = child.pid;
+    if (typeof pid !== "number" || pid <= 0) {
+      try {
+        child.kill(signal);
+      } catch {
+        /* already gone / fake with no kill */
+      }
+      return;
+    }
+    try {
+      if (process.platform === "win32") {
+        const r = this._deps.spawnSync(
+          "taskkill",
+          ["/pid", String(pid), "/T", "/F"],
+          { windowsHide: true },
+        );
+        // If taskkill couldn't launch, fall back to a direct kill.
+        if (r && r.error) child.kill(signal);
+      } else {
+        // Negative pid → the whole process group (requires the detached spawn).
+        try {
+          process.kill(-pid, signal);
+        } catch {
+          child.kill(signal);
+        }
+      }
+    } catch {
+      try {
+        child.kill(signal);
+      } catch {
+        /* already gone */
+      }
+    }
+  }
+
+  /** Install the process-exit reaper exactly once, only when a child exists. */
+  _installExitHook() {
+    if (this._exitHookInstalled) return;
+    this._exitHookInstalled = true;
+    process.once("exit", this._exitHook);
+  }
+
+  /** Append a result record, bounded to the most recent RESULT_RING. */
+  _pushResult(rec) {
+    this._results.push(rec);
+    if (this._results.length > RESULT_RING) this._results.shift();
+  }
+
   /**
    * Dispatch a batch of async hooks fire-and-forget. Returns IMMEDIATELY with a
    * per-hook disposition (`{command, dispatched, reason?}`) — it never awaits a
@@ -100,7 +174,7 @@ class AsyncHookSupervisor {
         });
         // Record the skip so the caller/agent can SEE that a hook was dropped
         // (silent truncation would read as "the hook ran and said nothing").
-        this._results.push({
+        this._pushResult({
           command: hook.command,
           event: hook.event || null,
           ok: false,
@@ -121,6 +195,9 @@ class AsyncHookSupervisor {
   }
 
   _spawnOne(hook, payload, opts) {
+    // A live child now exists — arm the exit reaper so a session never leaves
+    // an orphan hook process (installed once, only from here).
+    this._installExitHook();
     const key = this._key(hook);
     const started = this._deps.now();
     const rawTimeout = Number(
@@ -136,6 +213,10 @@ class AsyncHookSupervisor {
       child = this._deps.spawn(hook.command, {
         cwd: opts.cwd || process.cwd(),
         shell: true,
+        // POSIX: own process group so a timeout / stopAll can signal the whole
+        // tree (shell + the real hook command), not just the shell wrapper.
+        // No-op on Windows, where the tree is reaped via `taskkill /T` instead.
+        detached: process.platform !== "win32",
         env: {
           ...process.env,
           CLAUDE_HOOK_EVENT: hook.event || payload.hook_event_name || "",
@@ -158,6 +239,13 @@ class AsyncHookSupervisor {
     this._running.set(key, rec);
 
     try {
+      // `.end(data)` flushes ASYNCHRONOUSLY: if the hook exited before consuming
+      // stdin (a fast command), the write fails with an async EPIPE emitted as an
+      // 'error' event on the stream — NOT a sync throw this catch can see. With no
+      // listener that becomes an uncaught exception that crashes the process (seen
+      // on Linux CI). Attach a no-op error handler first so a closed-stdin write
+      // is swallowed as the non-fatal condition it is.
+      child.stdin?.on("error", () => {});
       child.stdin?.end(JSON.stringify(payload));
     } catch {
       /* stdin may already be closed — non-fatal */
@@ -171,11 +259,9 @@ class AsyncHookSupervisor {
 
     const timer = setTimeout(() => {
       killedByTimeout = true;
-      try {
-        child.kill("SIGTERM");
-      } catch {
-        /* already gone */
-      }
+      // Tree-kill: a hook that spawned a subprocess (e.g. `npm test`) must not
+      // leave that subprocess orphaned when it exceeds its timeout.
+      this._killChildTree(child, "SIGTERM");
     }, timeout);
     if (typeof timer.unref === "function") timer.unref();
     rec.timer = timer;
@@ -240,11 +326,12 @@ class AsyncHookSupervisor {
       ts: now,
       ms: fields.started != null ? now - fields.started : 0,
     };
-    this._results.push(rec);
+    this._pushResult(rec);
     // A rewake fires only for a hook that OPTED IN and finished in a failure
     // state — a passing async check should not re-engage the agent.
     if (hook.asyncRewake && !rec.ok) {
       this._rewakes.push(rec);
+      if (this._rewakes.length > RESULT_RING) this._rewakes.shift();
     }
   }
 
@@ -283,11 +370,9 @@ class AsyncHookSupervisor {
       } catch {
         /* ignore */
       }
-      try {
-        rec.child.kill("SIGTERM");
-      } catch {
-        /* already gone */
-      }
+      // Tree-kill (not a bare child.kill) so a session end / process exit never
+      // leaves an orphaned hook subprocess — the guarantee this class documents.
+      this._killChildTree(rec.child, "SIGTERM");
       this._running.delete(key);
     }
     try {
@@ -295,6 +380,7 @@ class AsyncHookSupervisor {
     } catch {
       /* ignore */
     }
+    this._exitHookInstalled = false;
   }
 }
 

package/src/lib/audit-logger.js

@@ -5,6 +5,7 @@
 
 import crypto from "crypto";
 import { safeJsonParse } from "./safe-json.js";
+import { escapeLike } from "./sql-like.js";
 
 /**
  * Event types for audit logging.
@@ -183,13 +184,13 @@ export function queryLogs(db, filters = {}) {
   }
 
   if (filters.operation) {
-    sql += " AND operation LIKE ?";
-    params.push(`%${filters.operation}%`);
+    sql += " AND operation LIKE ? ESCAPE '\\'";
+    params.push(`%${escapeLike(filters.operation)}%`);
   }
 
   if (filters.actor) {
-    sql += " AND actor LIKE ?";
-    params.push(`%${filters.actor}%`);
+    sql += " AND actor LIKE ? ESCAPE '\\'";
+    params.push(`%${escapeLike(filters.actor)}%`);
   }
 
   if (filters.riskLevel) {
@@ -214,8 +215,8 @@ export function queryLogs(db, filters = {}) {
 
   if (filters.search) {
     // Search in operation field (primary search field for CLI)
-    sql += " AND operation LIKE ?";
-    params.push(`%${filters.search}%`);
+    sql += " AND operation LIKE ? ESCAPE '\\'";
+    params.push(`%${escapeLike(filters.search)}%`);
   }
 
   sql += " ORDER BY created_at DESC";

package/src/lib/autonomous-developer.js

@@ -151,6 +151,66 @@ export function ensureAutonomousDevTables(db) {
   );
 }
 
+/**
+ * Rehydrate _sessions/_adrs from the persisted dev_sessions/
+ * architecture_decisions tables. The `cc` CLI runs every command in a fresh
+ * process, so without this the Maps start empty and a session/ADR created in a
+ * prior invocation is invisible (`cc dev list`/`show`/`adrs` show nothing) and
+ * every mutation — recordADR, advancePhase, etc. — throws "Session not found"
+ * against the empty Map. Call after ensureAutonomousDevTables(db).
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  _sessions.clear();
+  _adrs.clear();
+
+  const parse = (v, fallback) => {
+    if (v == null) return fallback;
+    try {
+      return JSON.parse(v);
+    } catch {
+      return fallback;
+    }
+  };
+
+  const sessionRows = db.prepare(`SELECT * FROM dev_sessions`).all();
+  for (const row of sessionRows) {
+    _sessions.set(row.session_id, {
+      sessionId: row.session_id,
+      requirement: row.requirement,
+      currentPhase: row.current_phase,
+      status: row.status,
+      autonomyLevel: row.autonomy_level ?? 2,
+      codeChanges: parse(row.code_changes, []),
+      testResults: parse(row.test_results, null),
+      reviewFeedback: parse(row.review_feedback, null),
+      startedAt: row.started_at,
+      completedAt: row.completed_at ?? null,
+      createdBy: row.created_by ?? null,
+      updatedAt: row.updated_at,
+      _seq: ++_seq,
+    });
+  }
+
+  const adrRows = db.prepare(`SELECT * FROM architecture_decisions`).all();
+  for (const row of adrRows) {
+    _adrs.set(row.adr_id, {
+      adrId: row.adr_id,
+      sessionId: row.session_id,
+      title: row.title,
+      context: row.context,
+      decision: row.decision,
+      consequences: row.consequences ?? "",
+      alternatives: parse(row.alternatives, []),
+      status: row.status,
+      createdAt: row.created_at,
+      _seq: ++_seq,
+    });
+  }
+
+  return _sessions.size + _adrs.size;
+}
+
 /* ── Catalogs ──────────────────────────────────────────────── */
 
 export function listAutonomyLevels() {

package/src/lib/chat-core.js

@@ -134,6 +134,11 @@ export async function streamOllama(
   const reader = response.body.getReader();
   const decoder = new TextDecoder();
   let fullResponse = "";
+  // Buffer incomplete lines across reads: an NDJSON line can be split across two
+  // stream chunks (TCP doesn't align to '\n'), so parsing each chunk in
+  // isolation would drop the split line entirely (both halves fail JSON.parse).
+  // Keep the trailing partial for the next read — same pattern as streamAnthropic.
+  let buf = "";
 
   try {
     while (true) {
@@ -141,10 +146,12 @@ export async function streamOllama(
       if (done) break;
       guard.bump();
 
-      const text = decoder.decode(value, { stream: true });
-      const lines = text.split("\n").filter(Boolean);
+      buf += decoder.decode(value, { stream: true });
+      const lines = buf.split("\n");
+      buf = lines.pop() || "";
 
       for (const line of lines) {
+        if (!line) continue;
         try {
           const json = JSON.parse(line);
           if (json.message?.content) {
@@ -225,6 +232,11 @@ export async function streamOpenAI(
   const reader = response.body.getReader();
   const decoder = new TextDecoder();
   let fullResponse = "";
+  // Buffer incomplete lines across reads: an SSE `data:` line can be split
+  // across two stream chunks, so parsing each chunk in isolation would drop the
+  // split line (both halves fail JSON.parse) — losing content and usage. Keep
+  // the trailing partial for the next read — same pattern as streamAnthropic.
+  let buf = "";
 
   try {
     while (true) {
@@ -232,8 +244,9 @@ export async function streamOpenAI(
       if (done) break;
       guard.bump();
 
-      const text = decoder.decode(value, { stream: true });
-      const lines = text.split("\n").filter(Boolean);
+      buf += decoder.decode(value, { stream: true });
+      const lines = buf.split("\n");
+      buf = lines.pop() || "";
 
       for (const line of lines) {
         if (line.startsWith("data: ")) {

package/src/lib/collaboration-governance.js

@@ -129,6 +129,62 @@ export function ensureGovernanceTables(db) {
   );
 }
 
+/**
+ * Rehydrate _decisions/_agentLevels from the persisted governance_decisions/
+ * autonomy_levels tables. The `cc` CLI runs every command in a fresh process, so
+ * without this the Maps start empty and a decision/level set in a prior
+ * invocation is invisible (`cc collab decisions`/`show`/`agents` show nothing),
+ * decision voting throws "not found", and setAutonomyLevel on a cold Map takes
+ * the INSERT branch on an already-persisted agent_id → PRIMARY KEY conflict.
+ * Call after ensureGovernanceTables(db).
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  _decisions.clear();
+  _agentLevels.clear();
+
+  const parse = (v, fallback) => {
+    if (v == null) return fallback;
+    try {
+      return JSON.parse(v);
+    } catch {
+      return fallback;
+    }
+  };
+
+  const decisionRows = db.prepare(`SELECT * FROM governance_decisions`).all();
+  for (const row of decisionRows) {
+    _decisions.set(row.decision_id, {
+      decisionId: row.decision_id,
+      type: row.type,
+      proposal: row.proposal,
+      status: row.status,
+      votes: parse(row.votes, {}),
+      resolution: row.resolution ?? null,
+      executedAt: row.executed_at ?? null,
+      createdAt: row.created_at,
+      updatedAt: row.updated_at,
+      _seq: ++_seq,
+    });
+  }
+
+  const levelRows = db.prepare(`SELECT * FROM autonomy_levels`).all();
+  for (const row of levelRows) {
+    _agentLevels.set(row.agent_id, {
+      agentId: row.agent_id,
+      currentLevel: row.current_level,
+      permissions: parse(row.permissions, []),
+      adjustmentHistory: parse(row.adjustment_history, []),
+      lastReviewAt: row.last_review_at ?? null,
+      createdAt: row.created_at,
+      updatedAt: row.updated_at,
+      _seq: ++_seq,
+    });
+  }
+
+  return _decisions.size + _agentLevels.size;
+}
+
 /* ── Catalogs ──────────────────────────────────────────────── */
 
 export function listDecisionTypes() {

package/src/lib/community-governance.js

@@ -129,6 +129,74 @@ export function ensureGovernanceTables(db) {
   );
 }
 
+/**
+ * Rehydrate _proposals/_votes/_proposalVotes from the persisted
+ * governance_proposals/governance_votes tables. The `cc` CLI runs every command
+ * in a fresh process, so without this the Maps start empty and a proposal/vote
+ * created in a prior invocation is invisible (`cc governance list`/`show`/
+ * `votes`/`tally`/`stats` show nothing) and activate/close/castVote throw
+ * "Proposal not found". Rebuilds the _proposalVotes proposalId→Set<voteId>
+ * index from the votes too. Call after ensureGovernanceTables(db).
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  _proposals.clear();
+  _votes.clear();
+  _proposalVotes.clear();
+
+  const parse = (v, fallback) => {
+    if (v == null) return fallback;
+    try {
+      return JSON.parse(v);
+    } catch {
+      return fallback;
+    }
+  };
+
+  const proposalRows = db.prepare(`SELECT * FROM governance_proposals`).all();
+  for (const row of proposalRows) {
+    _proposals.set(row.id, {
+      id: row.id,
+      title: row.title,
+      description: row.description ?? null,
+      type: row.type,
+      proposerDid: row.proposer_did ?? null,
+      status: row.status,
+      impactLevel: row.impact_level ?? null,
+      impactAnalysis: parse(row.impact_analysis, null),
+      voteYes: row.vote_yes ?? 0,
+      voteNo: row.vote_no ?? 0,
+      voteAbstain: row.vote_abstain ?? 0,
+      votingStartsAt: row.voting_starts_at ?? null,
+      votingEndsAt: row.voting_ends_at ?? null,
+      metadata: parse(row.metadata, null),
+      createdAt: row.created_at,
+      _seq: ++_seq,
+    });
+    _proposalVotes.set(row.id, new Set());
+  }
+
+  const voteRows = db.prepare(`SELECT * FROM governance_votes`).all();
+  for (const row of voteRows) {
+    _votes.set(row.id, {
+      id: row.id,
+      proposalId: row.proposal_id,
+      voterDid: row.voter_did,
+      vote: row.vote,
+      reason: row.reason ?? null,
+      weight: row.weight ?? 1.0,
+      createdAt: row.created_at,
+      _seq: ++_seq,
+    });
+    if (!_proposalVotes.has(row.proposal_id)) {
+      _proposalVotes.set(row.proposal_id, new Set());
+    }
+    _proposalVotes.get(row.proposal_id).add(row.id);
+  }
+
+  return _proposals.size + _votes.size;
+}
+
 /* ── Catalogs ──────────────────────────────────────────────── */
 
 export function listProposalTypes() {

package/src/lib/compliance-manager.js

@@ -723,6 +723,69 @@ export function _resetState() {
   _reportRetentionMs = COMPLIANCE_DEFAULT_REPORT_RETENTION_MS;
 }
 
+/**
+ * Rehydrate the in-memory _evidence/_policies Maps from the persisted
+ * compliance_* tables. The CLI runs each `cc compliance` subcommand in a fresh
+ * node process, so both Maps start empty every invocation. collectEvidence/
+ * addPolicy dual-write (Map + INSERT into compliance_evidence/compliance_policies)
+ * but generateReport (summary path), scanCompliance and listPolicies read the
+ * Maps only — so a `report`/`scan` after `evidence` in a separate process saw 0
+ * evidence items and scored 0. (The `report --detailed` path already SELECTed via
+ * the command-layer _loadEvidenceFromDb/_loadPoliciesFromDb; this makes the
+ * summary/scan/policies paths consistent.) `_reports` is write-only (no read
+ * path) and is not rehydrated. Call after ensureComplianceTables(db).
+ */
+export function loadFromDb(db) {
+  if (!db) return 0;
+  ensureComplianceTables(db);
+  _evidence.clear();
+  _policies.clear();
+
+  for (const r of db
+    .prepare(
+      `SELECT id, framework, type, description, source, status, collected_at
+         FROM compliance_evidence ORDER BY collected_at ASC`,
+    )
+    .all()) {
+    _evidence.set(r.id, {
+      id: r.id,
+      framework: r.framework,
+      type: r.type,
+      description: r.description || "",
+      source: r.source,
+      status: r.status,
+      collectedAt: r.collected_at,
+    });
+  }
+
+  for (const r of db
+    .prepare(
+      `SELECT id, name, type, framework, rules, enabled, severity, created_at
+         FROM compliance_policies ORDER BY created_at ASC`,
+    )
+    .all()) {
+    // One corrupt rules cell must not sink the whole policy load.
+    let rules = {};
+    try {
+      rules = r.rules ? JSON.parse(r.rules) : {};
+    } catch {
+      rules = {};
+    }
+    _policies.set(r.id, {
+      id: r.id,
+      name: r.name,
+      type: r.type,
+      framework: r.framework,
+      rules,
+      enabled: !!r.enabled,
+      severity: r.severity,
+      createdAt: r.created_at,
+    });
+  }
+
+  return _evidence.size + _policies.size;
+}
+
 // =====================================================================
 // compliance-manager V2 governance overlay (iter17)
 // =====================================================================