Ttimmahlax · Oct 8, 2026 · Oct 8, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -26,6 +26,42 @@ mechanics are in `.github/workflows/release.yml`.
 
 ## [Unreleased]
 
+### rusty_alloc 2.2.0 → 2.2.5
+
+Every crate that installs or calls the allocator moves to the exact pin
+`=2.2.5`. Because the pin is exact, a consumer that pins rusty_alloc itself
+has to move with it, so each crate takes a minor bump:
+
+| crate | from | to |
+|---|---|---|
+| `ffai-argus` (workspace version) | 0.7.5 | **0.8.0** |
+| `ffai-argus-wasm` | 0.1.3 | **0.2.0** |
+| `ffai-carmenta` | 0.11.0 | **0.12.0** |
+| `ffai-carmenta-wasm` | 0.2.3 | **0.3.0** |
+| `ffai-cli` | 0.7.0 | **0.8.0** |
+| `ffai-diana` | 0.7.8 | **0.8.0** |
+| `ffai-mercury-wasm` | 0.1.3 | **0.2.0** |
+| `ffai-wasm` | 0.1.5 | **0.2.0** |
+
+What the allocator fixes, as it affects FFai:
+
+- **2.2.5:** builds on MSVC with LTO and `panic = "unwind"`. That is our own
+  release profile (`lto = "thin"`, default panic), so 2.2.1 to 2.2.4 were
+  never an option on Windows.
+- **2.2.4:** freed model memory is no longer stranded after a loader thread
+  exits, and a freed huge block (over 32 MiB; Whisper-small's embedding is
+  152 MiB) is purged when purging is on.
+- **2.2.3:** on Windows with purging on, a failed re-commit is now an
+  allocation failure rather than an access violation.
+- **2.2.1:** `realloc` of a huge block copies the request, not the whole
+  reservation; process start-up makes 12 allocations instead of 263; a
+  cross-thread double free aborts instead of hanging.
+
+2.2.4 added public fields to `rusty_alloc::heap::Heap`. FFai never builds one
+with a struct literal, so nothing here changes.
+
+## [2026-09-28] — commercial gaps: core 0.8, carmenta 0.11, cli 0.7
+
 ### Versions
 
 | crate | from | to | why |

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -7,7 +7,7 @@ members = ["crates/*"]
 exclude = ["demo-ui"]
 
 [workspace.package]
-version = "0.7.5"
+version = "0.8.0"
 edition = "2024"
 rust-version = "1.95"
 license = "MIT OR Apache-2.0"
@@ -20,9 +20,9 @@ ffai-core = { path = "crates/ffai-core", version = "0.8.0" }
 ffai-media = { path = "crates/ffai-media", version = "0.6.8" }
 ffai-models = { path = "crates/ffai-models", version = "0.6.6" }
 ffai-mercury = { path = "crates/ffai-mercury", version = "1.0.5" }
-ffai-carmenta = { path = "crates/ffai-carmenta", version = "0.11.0" }
-ffai-diana = { path = "crates/ffai-diana", version = "0.7.8" }
-ffai-argus = { path = "crates/ffai-argus", version = "0.7.5" }
+ffai-carmenta = { path = "crates/ffai-carmenta", version = "0.12.0" }
+ffai-diana = { path = "crates/ffai-diana", version = "0.8.0" }
+ffai-argus = { path = "crates/ffai-argus", version = "0.8.0" }
 ffai-bench = { path = "crates/ffai-bench", version = "0.7.7" }
 
 # ---- tensor spine ----

diff --git a/crates/ffai-argus-wasm/CHANGELOG.md b/crates/ffai-argus-wasm/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-argus-wasm-v0.1.3...ffai-argus-wasm-v0.2.0) - 2026-10-08
+
+### Changed
+
+- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too
+
 ## [0.1.3](https://github.com/Remade-With-Rust/FFAI/compare/ffai-argus-wasm-v0.1.2...ffai-argus-wasm-v0.1.3) - 2026-09-25
 
 ### Other

diff --git a/crates/ffai-argus-wasm/Cargo.toml b/crates/ffai-argus-wasm/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "ffai-argus-wasm"
 description = "Argus in the browser — pure-Rust SmolVLM image captioning compiled to WebAssembly, no ONNX runtime, no Python"
-version = "0.1.3"
+version = "0.2.0"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
@@ -25,7 +25,7 @@ ffai-core = { workspace = true }
 # **0.7.2, not 0.7.1** — see the note in `ffai-mercury-wasm`. `SmolVlm::from_bytes`
 # and `ArgusBytes` first exist in 0.7.2, and a tarball verification resolves
 # this from crates.io rather than from the path.
-ffai-argus = { path = "../ffai-argus", version = "0.7.5", default-features = false }
+ffai-argus = { path = "../ffai-argus", version = "0.8.0", default-features = false }
 wasm-bindgen = "=0.2.121"   # pinned to the installed wasm-bindgen-cli; the two must match exactly
 
 # The binary is the only thing entitled to choose an allocator, and a cdylib IS
@@ -36,7 +36,7 @@ wasm-bindgen = "=0.2.121"   # pinned to the installed wasm-bindgen-cli; the two
 # feeding an autoregressive decoder with a growing KV cache — so
 # `--no-default-features` keeps the dlmalloc arm buildable for whoever takes
 # that measurement.
-rusty_alloc-api = { version = "=2.2.0", optional = true }
+rusty_alloc-api = { version = "=2.2.5", optional = true }
 
 # The gemm SIMD A/B, off by default. `gemm` is already in the tree beneath
 # candle; this makes its runtime switch reachable so a browser can measure

diff --git a/crates/ffai-argus/CHANGELOG.md b/crates/ffai-argus/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-argus-v0.7.5...ffai-argus-v0.8.0) - 2026-10-08
+
+### Changed
+
+- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too
+
 ## [0.7.5](https://github.com/Remade-With-Rust/FFAI/compare/ffai-argus-v0.7.4...ffai-argus-v0.7.5) - 2026-09-25
 
 ### Other

diff --git a/crates/ffai-argus/Cargo.toml b/crates/ffai-argus/Cargo.toml
@@ -63,7 +63,7 @@ getrandom = { version = "0.3", features = ["wasm_js"] }
 # places: a SigLIP/Llama forward allocates a 47 MB score tensor per layer, and
 # 47 MB is above the threshold where most allocators stop pooling and go
 # straight to the OS. See `examples/alloc_ab.rs`.
-rusty_alloc-api = "=2.2.0"
+rusty_alloc-api = "=2.2.5"
 
 # The step-3 oracle test reads the reference dump's summary.json.
 serde_json = { workspace = true }

diff --git a/crates/ffai-carmenta-wasm/CHANGELOG.md b/crates/ffai-carmenta-wasm/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-carmenta-wasm-v0.2.3...ffai-carmenta-wasm-v0.3.0) - 2026-10-08
+
+### Changed
+
+- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too
+
 ## [0.2.3](https://github.com/Remade-With-Rust/FFAI/compare/ffai-carmenta-wasm-v0.2.2...ffai-carmenta-wasm-v0.2.3) - 2026-09-25
 
 ### Other

diff --git a/crates/ffai-carmenta-wasm/Cargo.toml b/crates/ffai-carmenta-wasm/Cargo.toml
@@ -5,7 +5,7 @@ description = "Carmenta in the browser — pure-Rust OCR compiled to WebAssembly
 # slice. The JS signature is unchanged — it is still a `Uint8Array` — but the
 # Rust signature is, so this is a breaking change for a Rust consumer even
 # though a browser sees nothing. Adds `setDetMaxShort` and `linearMemoryBytes`.
-version = "0.2.3"
+version = "0.3.0"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
@@ -26,7 +26,7 @@ ffai-core = { workspace = true }
 # release calls `reqwest::blocking` — a module that does not exist on wasm32.
 # Nothing in a browser can fetch weights through the model cache anyway: the
 # caller supplies bytes.
-ffai-carmenta = { path = "../ffai-carmenta", version = "0.11.0", default-features = false }
+ffai-carmenta = { path = "../ffai-carmenta", version = "0.12.0", default-features = false }
 wasm-bindgen = "=0.2.121"   # pinned to the installed wasm-bindgen-cli; the two must match exactly
 serde = { workspace = true }
 serde_json = { workspace = true }
@@ -37,13 +37,13 @@ serde-wasm-bindgen = "0.6"
 # rusty_alloc at parity with dlmalloc on Diana's workload. Carmenta's
 # allocation pattern is different (many small line crops rather than one big
 # tensor chain), so the answer here is its own open measurement.
-rusty_alloc-api = { version = "=2.2.0", optional = true }
+rusty_alloc-api = { version = "=2.2.5", optional = true }
 # The allocator CORE, for `arena::reserve_os_memory_ex`. `rusty_alloc-api` is
 # the mi_*-compatible surface and does not re-export the arena module, but on
 # wasm the arena is the ONLY layer that recycles a freed segment — `prim::free`
 # is a no-op there because linear memory cannot shrink. Same version as the
 # api crate, so this adds no second copy of the allocator.
-rusty_alloc = { version = "=2.2.0", optional = true }
+rusty_alloc = { version = "=2.2.5", optional = true }
 
 [features]
 # **`rusty_alloc`, and the "open measurement" this comment used to ask for has

diff --git a/crates/ffai-carmenta/CHANGELOG.md b/crates/ffai-carmenta/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.12.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-carmenta-v0.11.0...ffai-carmenta-v0.12.0) - 2026-10-08
+
+### Changed
+
+- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too
+
 ## [0.11.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-carmenta-v0.10.2...ffai-carmenta-v0.11.0) - 2026-09-25
 
 ### Added

diff --git a/crates/ffai-carmenta/Cargo.toml b/crates/ffai-carmenta/Cargo.toml
@@ -38,7 +38,7 @@ description = "Carmenta — pure-Rust OCR: documents, screens, and a change-gate
 # (cord +0.0033 with a +0.1928 clip, doc +0.0395 with a +0.2920 clip) — the same
 # failure the 544x960 arm produced, smaller. 1280 is the only arm that improves
 # both with no badly-regressing clip. The table lives on `DET_MAX_SHORT_DEFAULT`.
-version = "0.11.0"
+version = "0.12.0"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
@@ -84,7 +84,7 @@ tokenizers = { version = "0.23", default-features = false, features = ["unstable
 mimalloc = { version = "0.1", default-features = false }
 # Superseded as the default by the pure-Rust remake; see the allocator
 # doc comment in `ffai-cli/src/main.rs` for the measurement.
-rusty_alloc-api = "=2.2.0"
+rusty_alloc-api = "=2.2.5"
 ffai-media = { path = "../ffai-media" }
 ffai-bench = { path = "../ffai-bench" }
 

diff --git a/crates/ffai-cli/CHANGELOG.md b/crates/ffai-cli/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-cli-v0.7.0...ffai-cli-v0.8.0) - 2026-10-08
+
+### Changed
+
+- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too
+
 ## [0.7.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-cli-v0.6.9...ffai-cli-v0.7.0) - 2026-09-25
 
 ### Added

diff --git a/crates/ffai-cli/Cargo.toml b/crates/ffai-cli/Cargo.toml
@@ -2,7 +2,7 @@
 name = "ffai-cli"
 description = "The ffai binary — a thin shell over the FFai library crates"
 # follows its dependencies.
-version = "0.7.0"
+version = "0.8.0"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
@@ -64,10 +64,10 @@ mimalloc = { version = "0.1", default-features = false, optional = true }
 # It reproduced in the CLI (which declares this allocator) and never in an
 # example (which declared none and got the system one), and that difference is
 # what finally identified it.
-rusty_alloc-api = "=2.2.0"
+rusty_alloc-api = "=2.2.5"
 # The core, for `alloc::collect` — see `spawn_page_trimmer` in main.rs.
 # Without it rusty_alloc's RSS does not bound on a rayon pool.
-rusty_alloc = "=2.2.0"
+rusty_alloc = "=2.2.5"
 clap = { workspace = true }
 
 [features]

diff --git a/crates/ffai-diana/CHANGELOG.md b/crates/ffai-diana/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-diana-v0.7.8...ffai-diana-v0.8.0) - 2026-10-08
+
+### Changed
+
+- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too
+
 ## [0.7.8](https://github.com/Remade-With-Rust/FFAI/compare/ffai-diana-v0.7.7...ffai-diana-v0.7.8) - 2026-09-25
 
 ### Other

diff --git a/crates/ffai-diana/Cargo.toml b/crates/ffai-diana/Cargo.toml
@@ -3,7 +3,7 @@ name = "ffai-diana"
 description = "Diana — FFai's detection component (YOLO26 on candle, pure Rust)"
 # 0.7.3 is a documentation-only republish: README restructured to the shared
 # Remade With Rust page layout. No code, API or output change.
-version = "0.7.8"
+version = "0.8.0"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
@@ -66,10 +66,10 @@ libmimalloc-sys = { version = "0.1", default-features = false }
 # margin the largest single effect in the Diana latency campaign (1.64x), so
 # it is simultaneously the dependency we most want to drop and the one that
 # costs the most to drop wrongly.
-rusty_alloc-api = "=2.2.0"
+rusty_alloc-api = "=2.2.5"
 # The core, for `alloc::collect` — the reclaim `examples/scaling.rs` drives.
 # `rusty_alloc-api` deliberately exposes collect only per-`Heap`.
-rusty_alloc = "=2.2.0"
+rusty_alloc = "=2.2.5"
 ffai-media = { path = "../ffai-media" }
 ffai-bench = { path = "../ffai-bench" }
 

diff --git a/crates/ffai-mercury-wasm/CHANGELOG.md b/crates/ffai-mercury-wasm/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0](https://github.com/Remade-With-Rust/FFAI/compare/ffai-mercury-wasm-v0.1.3...ffai-mercury-wasm-v0.2.0) - 2026-10-08
+
+### Changed
+
+- rusty_alloc and rusty_alloc-api `=2.2.0` -> `=2.2.5`: builds on MSVC with LTO and unwinding, frees model memory stranded by exited loader threads, purges freed huge blocks, and fails cleanly when Windows refuses a re-commit. The pin is exact, so a consumer that pins rusty_alloc itself must move to 2.2.5 too
+
 ## [0.1.3](https://github.com/Remade-With-Rust/FFAI/compare/ffai-mercury-wasm-v0.1.2...ffai-mercury-wasm-v0.1.3) - 2026-09-25
 
 ### Other