Module last_good 

The operator source’s last-good-revision state, held across rebuilds.

From the owner: “the PDS keeps the current policy it knows about until a new one replaces it. So you can see what WAS working vs. what won’t compile.” The three ways a bad new revision could be handled are not symmetric – dropping the policy widens what an agent may do, and denying everything it covers turns a typo into an outage – so crate::merge::build keeps enforcing the last revision of a policy that did compile, for exactly as long as its successor keeps failing.

What this is not

Not a cache of compiled artifacts: LastGoodPolicies holds the last ParsedPolicy that compiled cleanly, and crate::merge::build recompiles it fresh on every rebuild via crate::compile::resolve_predicate – cheap, and exactly the “idempotent and re-runnable” property didbot_policy::Evaluator::compile already has to have for an out-of-process evaluator restarting with nothing. Not a revision-ordering mechanism either: this is the layer above whatever produced the current view, deciding what to enforce when the newest observation does not compile.

The two states an operator must be able to tell apart

• Was working, new revision will not compile. The last good revision is enforced; the new one exists and failed. An edit that did not land, not an outage – reported as crate::merge::LastGoodFallback.
• Never compiled. Nothing to fall back to – this id has no entry here yet. Reported the ordinary, loud way, crate::compile::ScopedDenial, because a first-publish typo denying its own coverage is a real gap the operator gets no protection from, and must see.

Structs

Good 🔒

One id’s last successfully-compiled revision, held across rebuilds.

LastGoodPolicies

The operator source’s last-good-revision state. Empty and legitimate at startup – nothing has compiled yet, which is the “never compiled” state every id starts in, not an error.