chore(pins): move the conformance pin to cuda-oxide b0f961df

conformance/EXPECTED

@@ -11,3 +11,18 @@
 # safety model says to treat such a kernel as unsafe, so RC003 here is a
 # reviewed true positive, not an FP.
 conformance_constant_index_from_end	RC003	write_last	deny
+
+# conformance_unroll_bounds_check (all seven kernels) takes `arr: &mut [u32]`
+# as a `#[kernel]` parameter. The crate is upstream's regression corpus for a
+# bounds-check bug in the `#[unroll]` MIR transform -- the slice is there to
+# be indexed out of range on purpose (`arr[999] = 7`), not because anyone
+# should write a kernel that way. RC003 is correct on every one of them:
+# `&mut [T]` is one exclusive reference handed to every thread, and upstream's
+# own safety model says the same. Reviewed true positives, not FPs.
+conformance_unroll_bounds_check	RC003	control	deny
+conformance_unroll_bounds_check	RC003	full_after	deny
+conformance_unroll_bounds_check	RC003	full_before	deny
+conformance_unroll_bounds_check	RC003	full_inside	deny
+conformance_unroll_bounds_check	RC003	partial_after	deny
+conformance_unroll_bounds_check	RC003	partial_before	deny
+conformance_unroll_bounds_check	RC003	partial_inside	deny

conformance/MUTATION.md

@@ -11,13 +11,13 @@ hand; rerun the script and review the diff.
 
 | class | injected bug | expected | mutants | compiling | detected (default) | detected (`--strict`) |
 |-------|--------------|----------|--------:|----------:|-------------------:|----------------------:|
-| wrapbar | barrier wrapped in an index-derived `if` | RC001 | 78 | 78 | 56/78 (71%) | 73/78 (93%) |
+| wrapbar | barrier wrapped in an index-derived `if` | RC001 | 78 | 78 | 60/78 (76%) | 77/78 (98%) |
 | delbar | barrier deleted (data race) | - | 78 | 78 | 0/78 (0%) | 0/78 (0%) |
-| wrapcol | warp collective wrapped the same way | RC002 | 42 | 42 | 23/42 (54%) | 42/42 (100%) |
-| shrinkmask | full mask shrunk to `0x0000_ffff` | RC002 | 17 | 17 | 0/17 (0%) | 0/17 (0%) |
-| mutslice | `DisjointSlice<T>` param swapped to `&mut [T]` | RC003 | 447 | 424 | 424/424 (100%) | 424/424 (100%) |
+| wrapcol | warp collective wrapped the same way | RC002 | 35 | 35 | 23/35 (65%) | 35/35 (100%) |
+| shrinkmask | full mask shrunk to `0x0000_ffff` | RC002 | 10 | 10 | 0/10 (0%) | 0/10 (0%) |
+| mutslice | `DisjointSlice<T>` param swapped to `&mut [T]` | RC003 | 457 | 434 | 434/434 (100%) | 434/434 (100%) |
 
-**Precision at default confidence: 1.000** — 506 gating findings
+**Precision at default confidence: 1.000** — 576 gating findings
 across all compiling mutants, every one attributed to its injected bug
 or to the reviewed conformance baseline of its source example.
 
@@ -67,9 +67,9 @@ caps (from `mutation-report.tsv`):
 ```
 emitted_wrapbar	78
 emitted_delbar	78
-emitted_wrapcol	42
-emitted_shrinkmask	17
-emitted_mutslice	447
+emitted_wrapcol	35
+emitted_shrinkmask	10
+emitted_mutslice	457
 skipped_sites_outside_kernels	8
 skipped_unclassified_collectives	0
 skipped_tail_expression_collectives	4

conformance/PIN

@@ -2,4 +2,4 @@
 # Format of the data line: "<git sha> <github repo>".
 # Bump deliberately, in lockstep with the sample-crate pins, and review the
 # baseline diff it produces (see conformance/README.md).
-26754ae52c26c097dc1c465a1e42c4c5d05a3d40 NVlabs/cuda-oxide
+b0f961df3af0ff140b3b006fa2b6750b71f43f62 NVlabs/cuda-oxide

conformance/SURFACE_ALLOW

@@ -42,3 +42,4 @@ barrier_cluster_arrive	split cluster barrier: the arrival is non-blocking, only
 barrier_cluster_arrive_aligned	split cluster barrier: the arrival is non-blocking, only `barrier_cluster_wait*` can hang (explain/RC001.md)
 barrier_cluster_arrive_relaxed	split cluster barrier: the arrival is non-blocking, only `barrier_cluster_wait*` can hang (explain/RC001.md)
 barrier_cluster_arrive_relaxed_aligned	split cluster barrier: the arrival is non-blocking, only `barrier_cluster_wait*` can hang (explain/RC001.md)
+__grid_constant_config	compile-time launch-ABI marker (`#[grid_constant]`), `#[doc(hidden)]` and erased before codegen; emits no instruction and no synchronization

crates/cargo-reconverge/tests/check_cli.rs

@@ -653,7 +653,7 @@ fn sample_hang_is_confirmed_and_gates_the_exit() {
 /// from the cwd, and no test could see the two disagree.
 fn two_member_workspace(name: &str, default_members: Option<&str>) -> PathBuf {
     const DEP: &str = "cuda-device = { git = \"https://github.com/NVlabs/cuda-oxide\", \
-                       rev = \"26754ae52c26c097dc1c465a1e42c4c5d05a3d40\" }";
+                       rev = \"b0f961df3af0ff140b3b006fa2b6750b71f43f62\" }";
     let dir = Path::new(env!("CARGO_TARGET_TMPDIR")).join(name);
     let _ = fs::remove_dir_all(dir.join("crates"));
     let _ = fs::remove_file(dir.join("Cargo.toml"));
@@ -805,7 +805,7 @@ fn a_lib_and_a_bin_are_two_documents_that_name_their_targets() {
         "[workspace]\n\n[package]\nname = \"libbin\"\nversion = \"0.0.0\"\n\
          edition = \"2024\"\npublish = false\n\n[dependencies]\n\
          cuda-device = { git = \"https://github.com/NVlabs/cuda-oxide\", \
-         rev = \"26754ae52c26c097dc1c465a1e42c4c5d05a3d40\" }\n",
+         rev = \"b0f961df3af0ff140b3b006fa2b6750b71f43f62\" }\n",
     )
     .unwrap();
     fs::write(
@@ -973,7 +973,7 @@ fn a_witness_does_not_outlive_the_finding_it_replays() {
         "[workspace]\n\n[package]\nname = \"stale\"\nversion = \"0.0.0\"\n\
          edition = \"2024\"\npublish = false\n\n[dependencies]\n\
          cuda-device = { git = \"https://github.com/NVlabs/cuda-oxide\", \
-         rev = \"26754ae52c26c097dc1c465a1e42c4c5d05a3d40\" }\n",
+         rev = \"b0f961df3af0ff140b3b006fa2b6750b71f43f62\" }\n",
     )
     .unwrap();
     let divergent = "use cuda_device::{DisjointSlice, kernel, thread};\n\

crates/cargo-reconverge/tests/lint-samples/Cargo.toml

@@ -11,4 +11,4 @@ publish = false
 
 [dependencies]
 # Same pinned rev as the driver's sample crate; conformance/PIN records it.
-cuda-device = { git = "https://github.com/NVlabs/cuda-oxide", rev = "26754ae52c26c097dc1c465a1e42c4c5d05a3d40" }
+cuda-device = { git = "https://github.com/NVlabs/cuda-oxide", rev = "b0f961df3af0ff140b3b006fa2b6750b71f43f62" }

crates/cargo-reconverge/tests/render-probe/Cargo.toml

@@ -13,4 +13,4 @@ publish = false
 
 [dependencies]
 # Same pinned rev as the driver's sample crate; conformance/PIN records it.
-cuda-device = { git = "https://github.com/NVlabs/cuda-oxide", rev = "26754ae52c26c097dc1c465a1e42c4c5d05a3d40" }
+cuda-device = { git = "https://github.com/NVlabs/cuda-oxide", rev = "b0f961df3af0ff140b3b006fa2b6750b71f43f62" }

crates/reconverge-driver/tests/sample-kernels/Cargo.toml

@@ -14,4 +14,4 @@ publish = false
 # emits just the renamed no_mangle function and no host-side lookup
 # machinery. Pinned to the upstream rev recorded in conformance/PIN; moving the
 # pin into conformance/PIN.
-cuda-device = { git = "https://github.com/NVlabs/cuda-oxide", rev = "26754ae52c26c097dc1c465a1e42c4c5d05a3d40" }
+cuda-device = { git = "https://github.com/NVlabs/cuda-oxide", rev = "b0f961df3af0ff140b3b006fa2b6750b71f43f62" }

rust-toolchain.toml

@@ -1,6 +1,6 @@
 # Pinned in lockstep with upstream cuda-oxide: a rustc-driver tool must be
 # built by the same rustc it wraps. Verified against
-# NVlabs/cuda-oxide@26754ae5. Bump only together with the upstream pin, and
+# NVlabs/cuda-oxide@b0f961df. Bump only together with the upstream pin, and
 # never in a change that also alters analysis behavior — one at a time.
 [toolchain]
 channel = "nightly-2026-08-28"