Seam walk: 19 stub returns + tantivy compile error + 13 test panics (audit 2026-06-01)

[hyperpolymath]

Background

Owner directive: meander, walk the seams, check for rubbish lying around, follow every execution path, identify any bugs (syntax, logic, doc mismatch). Audit on 2026-06-01.

Three highest-impact findings

1. rust-core/verisim-document/src/lib.rs:279 — tantivy 0.26 compile error. TopDocs::with_limit(N) no longer impls Collector in tantivy 0.26.1. Entire document modality store dead. Blocks 13/16 CI checks. Fix in PR fix(verisim-document): tantivy 0.26 collector API — add .order_by_score() #76.

2. rust-core/verisim-nif/src/lib.rs:70-93 — NIF bridge returns empty JSON placeholders. All 8 NIF entry points (create, get, delete, search_text, search_vector, list, drift, normalize) return {'status': 'nif_placeholder', 'message': '...integration pending'} without touching the store. CLAUDE.md claims 'low latency for same-node deployments' but NIF is a no-op. Direct Elixir→Rust calls via NIF provide zero functionality; users get silently dropped results.

3. Federation adapters — 5 silent failures.

   • elixir-orchestration/lib/verisim/federation/adapters/verisimdb.ex:221 — extract_results(_) → [] when response shape unknown
   • elixir-orchestration/lib/verisim/federation/adapters/surrealdb.ex:280 — extract_surreal_results(_body) → [] incomplete JSON parsing
   • elixir-orchestration/lib/verisim/federation/adapters/object_storage.ex:325,358 — both list parsers return []
   • These aren't optional features. Federation queries to these peers return empty silently; users don't know their data isn't there.

Top 30 findings by category

Stub functions (19 total):

• 8 NIF entry points (verisim-nif/src/lib.rs:70-93)
• 5 Elixir federation adapter response parsers
• 6 Gleam client modules: 18 'TODO: Implement full JSON decoding' across federation, octad, provenance, vql, search, drift

Ignored tests (4):

• rust-core/verisim-octad/tests/integration_tests.rs:248-319 — save_to_file/load_from_file not implemented on BruteForceVectorStore, InMemoryTensorStore, InMemorySemanticStore, InMemoryVersionStore

Panics in non-test code (13, all in test-assertion helpers — acceptable):

• verisim-planner/src/prepared.rs:1001,1121, verisim-normalizer/src/regeneration.rs:1128-1442 (11 panics), verisim-wal/src/entry.rs:386, verisim-provenance/src/lib.rs:522, verisim-storage/src/typed.rs:280

Unwraps:

• verisim-repl/src/vql_fmt.rs:447 — .unwrap() on output.lines().next() could panic on empty output (real bug, not test)
• ~200 in test code (cosmetic)

Stub Elixir returns (production paths):

• vql_executor.ex:536 — extract_embedding_from_modality(_) → [] (non-vector modality silently empty)
• vql_executor.ex:1800,1952 — wrap_provenance_results(_), wrap_spatial_results(_) both return []
• vql_type_checker.ex:164,189 — parse_proof_specs(nil/_) → []
• vql_executor.ex:782 — verify_multi_proof(_, nil) → {:ok, []} silently accepts nil proof list

Codebase health

Well-maintained: verisim-octad/vector/tensor/semantic/provenance/spatial/temporal — real implementations, no stubs, comprehensive tests. verisim-normalizer regeneration strategies do actual work (issue #1 resolved). VQL pipeline works. Orchestration (drift_monitor.ex, entity_server.ex, federation_executor.ex) is real. Zero unsafe blocks across all 18 crates with forbid directive.

Rot concentration: Client SDKs (Gleam JSON codecs incomplete). Federation adapters (verisimdb, surrealdb, object_storage response parsing returns [] on unrecognized format). NIF bridge advertised as working — isn't.

Totals

Category	Count
TODO/FIXME in code	0
Panics in non-test code	13 (all test-assertion helpers)
Unsafe blocks	0
Stub functions returning empty	19 (8 NIF + 5 federation + 6 Gleam)
Unwrap/expect in production code	~200
Compile errors	1 CRITICAL (PR #76 fixes)
KNOWN-ISSUES resolved	25/25

[hyperpolymath]

Terminology correction (2026-06-01): every occurrence of "VQL" in this issue refers to what is now canonically called VCL (VeriSim Consonance Language). The rename happened 2026-04-05 — see hyperpolymath/vcl-ut README ("Its former name used the letter sequence 'V-Q-L-hyphen-U-T'... The canonical name is now VCL-total"). The verisim repo's own files are still file-named VQL* (e.g. src/vql/VQL*.res, vql-bridge/, docs/VQL-SPEC.adoc); that rename is incomplete in-repo and is itself a separable cleanup task — 90 files reference VQL; 11 ReScript files in src/vql/ (4974 LOC); the lone migrated outpost is connectors/clients/elixir/lib/verisim_client/vcl.ex. Where this issue mentions "VQL semantics theorems" or "VQL grammar", read as "VCL semantics"/"VCL grammar"; the VCL-total variant (next-gen, type-safe, certified Idris2 + Rust trusted parser + Ed25519 attestation) lives separately at hyperpolymath/vcl-ut and would replace the verisim-internal VCL surface as the upstream source-of-truth.

[hyperpolymath]

Re-measured 2026-07-21 — three of the four headline findings are stale; one is factually wrong

Re-walked the seams against origin/main today. This audit was taken 2026-06-01; substantial work has landed since, and one finding was misclassified at the time.

The three "highest-impact findings"

1. tantivy 0.26 compile error — FIXED. PR #76 landed. verisim-document/src/lib.rs now uses TopDocs::with_limit(limit).order_by_score(). cargo check --workspace --all-targets exits 0 and cargo test --workspace gives 629 passed / 0 failed / 2 ignored across 46 binaries. The document modality is not dead and CI is not blocked by it.

2. NIF bridge returning empty JSON placeholders — the silent-data-loss half is FIXED. verisim-nif no longer fakes success. Every entry point now calls not_implemented() and returns a typed failure; the source even carries the note that delete_octad "previously returned {"status":"deleted"} without deleting anything — the silent-data-loss bug this stub exists to prevent." Callers now get a loud error instead of silently dropped results. The remaining work — a real implementation — is #61, and is blocked on the #86 A/B ruling (see my comment there).

3. Federation adapters, "5 silent failures" — no longer silent. extract_results/1 and extract_surreal_results/1 now match several response shapes and, on an unrecognised one, emit Logger.warning with a shape summary before returning []. resolver.ex:312 already handles a per-peer {:error, reason} by logging and contributing [] to the fanout, so a typed error would not crash anything.

The residual is narrower than described, and it is a design gap, not a stub: a partial failure is not surfaced to the API caller, so a client still cannot distinguish "this peer had no data" from "we could not parse this peer's reply". That belongs with the federation work in #78 area 21, not here.

Correction: the vql_fmt.rs:447 unwrap is test code

verisim-repl/src/vql_fmt.rs:447 — .unwrap() on output.lines().next() could panic on empty output (real bug, not test)

This is not a real bug. The file is now vcl_fmt.rs; #[cfg(test)] mod tests begins at line 352, so line 447 sits inside the test module — it is test_explain_select_same_line, an assertion helper. It belongs in the "panics in test-assertion helpers — acceptable" bucket alongside the other 13.

Still open

• 6 Gleam client modules with incomplete JSON decoding — moot: the Gleam SDK was removed in PR chore(rot): flush silent failures + drop Gleam SDK #85 and the use case absorbed by SNIFs verisim WASM bridge — single boundary for BEAM-side cross-language access #86.
• 4 ignored tests in verisim-octad/tests/integration_tests.rs (save_to_file/load_from_file unimplemented on four in-memory stores) — the 2 ignored in today's run.
• The Elixir stub returns in vql_executor.ex / vql_type_checker.ex. Note these files are now vcl_executor.ex / vcl_type_checker.ex; the paths in this issue no longer resolve.
• ~200 unwraps in test code (cosmetic, as recorded).

Suggested action: retitle to the genuine residual (octad save_to_file/load_from_file, the Elixir empty-list returns, and the federation partial-failure surface), or close in favour of #61 + #78.

[hyperpolymath]

Closing in favour of #61 and #78. Every claim re-walked on 2026-07-28 against a
pristine git archive origin/main export (14df4227).

Retracted — the vql_fmt.rs:447 "real bug, not test". The file is now
rust-core/verisim-repl/src/vcl_fmt.rs (511 lines) and #[cfg(test)] begins at
line 352. Line 447 is let first_line = output.lines().next().unwrap(); —
a test assertion, inside the test module. The .unwrap() is deliberate and
correct there. This claim was simply wrong and should not have been carried
forward twice.

Resolved — the "ignored tests" / octad save_to_file/load_from_file.
There are zero #[ignore] attributes anywhere in the tree. (The one grep
hit is prose: integration_tests.rs:7 states "There are no #[ignore]d tests
here.") Lines 236-243 record the decision — disk persistence is not a property
of the in-memory shapes and lives in the sibling Persistent* variants. Those
exist for six modalities, not the four originally named:
verisim-{vector,tensor,semantic,temporal,spatial,provenance}/src/persistent.rs.
grep -rn 'save_to_file\|load_from_file' --include='*.rs' returns exactly one
hit — the comment explaining why the API deliberately does not exist.

Resolved — the "silent" Elixir empty-list returns. They are no longer
silent: the federation adapters emit Logger.warning with a shape summary
before returning [], the type-checker catch-all logs, and the dangerous
verify_multi_proof catch-all now returns {:error, {:invalid_proof_specs, …}}.
parse_proof_specs(nil) -> [] is a nil-guard head, not a stub — validate_proof_specs([])
turns it into {:error, {:missing_proof, …}} downstream. One line of genuinely
dead code remains (vcl_executor.ex verify_multi_proof(_, nil), unreachable
because all three call sites guard with if proof); it is cleanup, not a defect.

Resolved — the 6 Gleam client modules. connectors/clients/ now holds
elixir julia rescript rust zig. The Gleam SDK was removed in #85 and its
use-case absorbed by #86.

Resolved — the tantivy 0.26 compile error. #76.

Still open, tracked elsewhere — the NIF bridge. verisim-nif is now an
honest scaffold: every entry point returns {:error, :not_implemented}, so
the silent-data-loss hazard (a write reported as success) is gone and there is
no correctness pressure. That is #61 — and per the #86 ruling it is about to be
closed as subsumed by the WASM+SNIF path rather than implemented as specified.

Nothing actionable remains here that #61 and #78 do not already carry.
Category-level scanner findings are tracked in #203.