docs(hardware): session #2, the sanitizer cross-check on an A10G

[vyncint]

Closes #153. The first external check on this project's accuracy claims — every other number here is measured against a corpus the project wrote for itself.

36 labeled mutants across barrier, lanemask_scan and scoped_atomic_load_store, on a rented g5.xlarge (NVIDIA A10G, CC 8.6, driver 595.71.05, CUDA 13.2), cuda-oxide b0f961df on nightly-2026-08-28. Same mutation operators as the static corpus, applied to whole upstream examples so the kernels actually launch, each run under compute-sanitizer --tool synccheck.

class	expected	reconverge, static	on the A10G under synccheck (n)
wrapbar	RC001	76% default, 98% --strict	4 hang, 2 flagged, 3 passed (9)
wrapcol	RC002	65% default, 100% --strict	3 hang, 1 build error (4)
shrinkmask	RC002	0%, published as such	7 passed, 0 flagged (7)
mutslice	RC003	100%	7 passed, 0 flagged (7)
delbar	— (a race)	0%, by design	2 flagged, 1 hang, 6 passed (9)

Four results, and one is not in this tool's favour

RC003 is invisible to the dynamic checker. Seven mutslice mutants — one &mut [T] handed to every thread — ran to completion with nothing reported. reconverge denies every one from syntax alone. That is the sharpest split here: 100% against 0% on the same labeled bugs.

Three of nine wrapbar mutants passed on hardware, no hang and nothing reported. This is the accidental pass the README has described since 0.1.0, measured rather than argued: a dynamic tool sees the launch you ran, not the launches your code allows.

shrinkmask is invisible to both. Zero static detection — published as expected recall 0 — and zero synccheck reports. This is the first evidence that the boundary belongs to the bug class rather than to this engine.

delbar is where the vendor's tool wins. synccheck flagged two deleted-barrier mutants this analysis cannot see at all; a deleted barrier is a data race and outside the decidable slice by design. The README now says the two approaches are complementary rather than ranked, with the numbers behind it.

Two corrections fell out of running it

• session-2.md listed barrier_sync_test as an example to probe. It is a kernel inside the barrier example; the directory does not exist. Fixed, with the reason.
• atomics was not probed and no longer can be for the old finding: upstream rewrote it at this pin to take *mut u32 through DeviceAtomicU32::from_ptr instead of transmuting a shared slice, which is the shape that finding keyed on. (That rewrite is also why the conformance RC001/RC002 count dropped from 8 to 4 in chore(pins): move the conformance pin to cuda-oxide b0f961df #161.)

How it ran

Unattended from EC2 user-data, because ssm:StartSession is denied to this account's role and gpu-sg has no inbound rules. Three earlier attempts died mid-probe with nothing published — that is cloud-init's own service timing out and systemd killing its cgroup, which no trap inside it survives. The work is detached with setsid in the run that produced this, and publishes after every example so a later death cannot erase an earlier result.