Logs

Bustan 0.0.2 now rejects request-scoped providers injected into singletons. Took most of the day, and almost all of it went on the error message rather than the check.

The check itself is a graph walk. The message is the part people actually meet:

BustanScopeError: RequestContext is request-scoped and cannot be
injected into TaskService, which is a singleton.

  TaskService (singleton)
    └── RequestContext (request)

  A singleton is constructed once, so it would capture the first
  request's RequestContext and keep it for every request after.

  hint: make TaskService request-scoped, or inject a factory

The three-line explanation matters more than the detection. This bug, left in, surfaces weeks later under load as one user seeing another user's data — and by then nobody connects it to a constructor signature.

Also finally deleted the lazy-resolution path. It had been off by default since 0.0.1 and existed only so a test could avoid building the full graph. Tests that avoid the real thing were not worth a second resolution strategy.

Spent the day on ZTVS's on-disk verification, which is the feature that makes 0.0.2 worth releasing. Resolving a lockfile is easy; proving the lockfile describes the filesystem is not.

The naive version stats every file for every package and took 41s on a mid-sized Rust project. Rewrote it to walk the tree once, building a digest index keyed by path, then match packages against the index:

// one pass over the tree, not one pass per package
let index = DigestIndex::build(root)?;
for pkg in resolved {
    match index.verify(&pkg) {
        Verified => report.verified(pkg),
        Missing => report.discrepancy(pkg, Missing),
        Altered { expected, found } => report.discrepancy(pkg, Altered { expected, found }),
    }
}

41s → 2.3s. Obvious in hindsight, which is the usual shape of these.

The more interesting decision was what to do with Altered. First instinct was to treat it as a finding. It is not — it is a discrepancy, and it belongs in its own section. A patched binary might be a supply-chain compromise or it might be a vendored fix someone applied deliberately. The scanner does not know, and pretending otherwise would make it exactly the kind of tool that cries wolf.