Umbrella: low-severity findings from the 2026-08-02 full review (F-18 a-i) #144

Grouped low-severity items from the 2026-08-02 full-repo review (finding F-18); split out sub-issues if/when picked up. Pattern follows #14.

• (a) Dual SymbolDecl storage — inputs/params are copied into m_inputs_cache/m_parameters_cache (recipe.h:339-398); ensure_dt_symbol_registered_ must set is_time_step on both copies (recipe.h:1048-1049). Store indices into m_symbols instead (the codebase already prefers index-over-pointer elsewhere).
• (b) Role equality is name-only; attribute-mismatch guard covers only the built-in catalogue (recipe.h:73-76, validate_role_attributes 1001-1024). Two custom roles sharing a name with different attributes silently coexist. Track first-seen custom role names per model and reject re-declaration with different attributes.
• (c) roles:: globals are dynamically initialized — SIOF trap, self-documented at recipe.h:84-89; the examples' registry pattern is one static ConstitutiveModel away. Meyers-singleton accessors would close it (API break — batch with another break).
• (d) Eager-branch piecewise evaluation — untaken if_then_else branch still evaluates (NaN hazard for guarded inv/log/sqrt); documented at tensor_code_emit.h:160-167. Fix requires statement-level branch lowering; keep on the roadmap (interacts with Local-Newton robustness: detect non-convergence + guard singular Jacobian (scalar + coupled) #85's NaN policy).
• (e) HeaderPurity is a substring grep (cmake/check_header_purity.cmake:38-45) — matches comments (false-positive class) and does not test self-containment (false-negative class). Add a per-header lone-TU compile target; all public headers currently pass (verified g++-14/C++23), so it starts green.
• (g) Default LA policy defaulted in 3+ places — recipe.h:677, recipe_render.h:115, CodeEmitPass fallback pass_bodies.h:592-594, per-target ctors. Make PassContext::linear_algebra unconditionally set in one place; drop the fallback.
• (h) Document copy semantics of ConstitutiveModel — copies share cas leaf nodes (safe today since leaf mutation happens only at declaration time — but a latent trap for future post-copy mutation), and state-variable handles do not rebind to copies (model_token check).
• (i) API polish — dead type param on CodeGenContext::emit_temporary (codegen_context.h:68); duplicate Kind enums (recipe.h:130 vs 271); auto const&-returning public accessors hide their types (recipe.h:895-901); target-factory triple sync (names vector / if-chain / default constant) → one static table.

(f) install-rule gating + LICENSE install was filed with the packaging issue #133.