eos: guard null thermo in apply_primitive_limiter_

[cshsgy]

Summary

• apply_conserved_limiter_ already guards options->thermo() before reading vapor/cloud species counts; apply_primitive_limiter_ did not, so any species-free EOS (e.g. ideal-gas) dereferenced a null thermo() every time the primitive limiter ran.
• In release builds this doesn't throw — it silently corrupts the tracer slice of prim. Once a column's density/pressure get low enough (e.g. a strong transient updraft), the corrupted state reaches the implicit vertical solver as a singular Jacobian, which then spins retrying without bound.

How this was found

Reproduced on a cubed-sphere Jupiter case:

• ideal-gas with limiter: false loses all density/pressure flooring entirely and crashes via a singular LU decomposition in the vertical implicit solver.
• ideal-gas with limiter: true instead hits this null-thermo path and corrupts state (some columns pinned exactly at the density/pressure floor, others with velocities ~1e30+).
• An identical run using ideal-moist with trace (~1e-10) vapor species — same forcing, same cold start, same perturbation — has no such bug (thermo() is non-null there) and survives the same event cleanly. This isolated the failure to the one line fixed here.

Confirmed the fix directly by constructing a low-density/high-momentum cell (the exact failure shape: tiny density, huge momentum, energy far too small for the resulting kinetic energy) and calling U->W on an ideal-gas block with limiter: true: before the fix this corrupts memory; after, density and pressure clamp cleanly to their floors as intended.

Test plan

• pre-commit run passes on the changed file
• snap_release builds clean
• Direct unit-level repro: engineered conserved state (rho=1e-10, mom=1e6, E=1e5) through ideal-gas EOS compute("U->W", ...) with limiter: true — before: undefined behavior / memory corruption; after: rho and p clamp to their configured floors, no crash
• Confirmed the bug does not reproduce under ideal-moist with trace species (same driver/config otherwise), isolating the fix to this code path

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Fixes a null-dereference/UB in the EOS primitive limiter path when running species-free EOS configurations (e.g., ideal-gas) by guarding access to options->thermo() before clamping tracer-related primitive entries. This aligns apply_primitive_limiter_ with the existing safety behavior already present in apply_conserved_limiter_, preventing silent state corruption that can propagate into the implicit vertical solver.

Changes:

• Add a options->thermo() null guard around vapor/cloud tracer clamping in EquationOfStateImpl::apply_primitive_limiter_.
• Document why the guard is required (species-free EOS types have unset thermo() and previously triggered UB).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cshsgy]

Additional end-to-end confirmation on v2.7.5 (avoids an unrelated main-only regression in the cubed-sphere layout's yaml backend/device parsing that prevented a full run on tip-of-main): built this fix on a v2.7.5 worktree and re-ran the exact cubed-sphere Jupiter case that originally crashed.

Before the fix (same case, ideal-gas, limiter: true): pressure collapses geometrically column-by-column (p_min 2249 → 1936 → 1578 → 1205 → 860 → 612 Pa over cycles 1150–1175) until the corrupted state reaches the implicit solver.

After the fix, same forcing/IC/perturbation, same extreme event (v1max ~1509 m/s, same magnitude as before): p_min stays flat and healthy (8817 → 8814 → 8813 → 8816 Pa), rho_min stays flat (~0.0218), and all 6 ranks run cleanly past the previous crash point (cycle 1189) with no singular matrix and no corrupted state.