From the 2026-08-02 full-repo review (finding F-09). Reproduced via direct construction.
Evidence: scalar_code_emit.h:103-113, tensor_code_emit.h:112-119, tensor_to_scalar_code_emit.h:162-169 all do m_result = "-" + inner; when is_single_token(inner) — which checks for spaces/parens but not a leading -. cas::make_expression<cas::scalar_constant>(-5.0) negated emits --5.0.
Reachability: today the public operator layer canonicalizes negative literals into scalar_negative(positive) (verified in numsim-cas at the current pin), so normal recipes cannot hit this. The emitters silently rely on that unenforced upstream invariant; any future cas simplifier change or direct constant construction (the same public factory used throughout recipe.h) reproduces it with zero diagnostic.
Fix: in the three *_negative visitors: if (inner starts with '-') m_result = "-(" + inner + ")";. One unit test with a directly-constructed negative constant.
From the 2026-08-02 full-repo review (finding F-09). Reproduced via direct construction.
Evidence:
scalar_code_emit.h:103-113,tensor_code_emit.h:112-119,tensor_to_scalar_code_emit.h:162-169all dom_result = "-" + inner;whenis_single_token(inner)— which checks for spaces/parens but not a leading-.cas::make_expression<cas::scalar_constant>(-5.0)negated emits--5.0.Reachability: today the public operator layer canonicalizes negative literals into
scalar_negative(positive)(verified in numsim-cas at the current pin), so normal recipes cannot hit this. The emitters silently rely on that unenforced upstream invariant; any future cas simplifier change or direct constant construction (the same public factory used throughout recipe.h) reproduces it with zero diagnostic.Fix: in the three
*_negativevisitors:if (inner starts with '-') m_result = "-(" + inner + ")";. One unit test with a directly-constructed negative constant.