--watch: validate-then-swap — a bad .build.ae edit must keep the last-good build state

[paul-hammant]

Motivation

blazerules' hot-reload contract: it compiles and validates the new YAML/lookups off the hot path, then swaps atomically only on success; a failed reload keeps the previous ruleset active and batches keep the ruleset observed at batch start.

aeb's --watch mode is the direct analogue. Today a change fires the affected-target walk and a narrowed rebuild. The gap: if an edited .build.ae fails to compile, the watch loop shouldn't leave the developer with a torn-down or half-built state — it should report the compile error and keep the last-good DAG/artifacts intact, so the editor round-trip is "fix the typo, save again, recover" rather than "now nothing builds."

Proposal

Give --watch a validate-then-swap contract:

• On a change event, run the scan + transform-ae/compile of the affected .build.ae files before touching any live build state.
• If scan/compile fails: print the error, keep the previously-good DAG and target/ artifacts, stay watching. Do not partially apply.
• If it succeeds: proceed with the narrowed rebuild as today (atomic swap of the DAG state).
• An in-flight rebuild triggered by an earlier event completes (or is cleanly superseded) before a newer event's rebuild starts — last-good is always coherent.

Acceptance criteria

• Introducing a syntax error in a watched .build.ae prints the compile error and leaves the last successful target/ artifacts in place (verifiable: the prior binary still runs).
• Fixing the error on the next save recovers to a green build with no manual aeb re-invocation.
• A rapid save-save-save burst never leaves a half-applied DAG.
• Behaviour documented in the README --watch section.

Not being asked

Not asking for multi-version ruleset history or rollback-to-arbitrary-generation. Just last-good-survives-a-bad-edit, the blazerules "failed reload keeps previous active" guarantee.