deps: bump to nightly-2026-08-28 + refresh the dep tree (and pin the old trait solver)

.cargo/audit.toml

@@ -2,11 +2,11 @@
 # SPDX-License-Identifier: MIT
 #
 # Accepted RustSec advisories — blocked by transitive deps or no fix available.
-# These are build-time (wayland-scanner proc-macro) or warnings (ttf-parser
-# unmaintained, latest version used), NOT runtime-exploitable in martin.
+# Warnings only (ttf-parser unmaintained, latest version used), NOT runtime-exploitable in martin.
+#
+# The two quick-xml advisories (RUSTSEC-2026-0194/0195) that used to sit here are GONE: both are
+# patched in quick-xml >= 0.41.0, and wayland-scanner now pulls that. Nothing to ignore.
 [advisories]
 ignore = [
-    "RUSTSEC-2026-0194",  # quick-xml: quadratic attrs (wayland-scanner, build-time only)
-    "RUSTSEC-2026-0195",  # quick-xml: unbounded ns alloc (wayland-scanner, build-time only)
     "RUSTSEC-2026-0192",  # ttf-parser: unmaintained (no newer version exists)
 ]

.cargo/config.toml

@@ -16,3 +16,23 @@ r-sh3 = "run --release --no-default-features --features sh3 --target-dir target/
 # target/fast/. For the edit→render loop; ship + CI still use plain --release.
 b-fast = "build --profile fast"
 r-fast = "run --profile fast"
+
+# ---------------------------------------------------------------------------------------------
+# TRAIT SOLVER: temporarily opt back out of the next-generation solver.
+#
+# nightly-2026-08-28 turns `-Znext-solver=globally` ON by default (rust-lang/rust#160619, announced
+# 2026-08-21). Under it, `bevy_render` 0.19.1 blows up: a single rustc peaks at ~13.3 GB RSS and is
+# OOM-killed on a 16 GB box, vs ~1.9 GB with the old solver — a ~7× regression that breaks both the
+# dev box and the 16 GB GitHub runners. The regression is confined to that one dependency: martin's
+# own crate builds clean under `-Znext-solver=globally` with deps on the old solver, and the bump
+# needed no source changes here (see CONTRIBUTING.md § The trait solver).
+#
+# `=coherence` is the documented opt-out — it keeps the new solver for coherence checking (where it
+# has been the default since 1.84) and uses the old one everywhere else, i.e. exactly the pre-bump
+# behaviour. RUSTFLAGS in the environment overrides this, so to re-test the next solver:
+#
+#   RUSTFLAGS="-Znext-solver=globally" cargo build --release
+#
+# REMOVE THIS once bevy_render compiles in reasonable memory — the old solver is slated for deletion.
+[build]
+rustflags = ["-Znext-solver=coherence"]

CHANGELOG.md

@@ -12,6 +12,25 @@ the project has no tagged releases yet, so everything lives under **Unreleased**
 
 ### Changed
 
+- **Toolchain bumped to `nightly-2026-08-28`** (was `nightly-2026-07-30`), and the whole dependency
+  tree refreshed — Bevy **0.19.1** (was 0.19.0), and **146 locked crates updated / 12 added / 2 removed**
+  (`wgpu` 29.0.4, `quick-xml` 0.41, `uuid` 1.26, `thiserror` 2.0.20, `zerocopy` 0.8.56, …; the new
+  `arboard`/`wl-clipboard-rs` come in with Bevy 0.19.1). Every direct dependency was already at its
+  latest major, so `Cargo.toml`'s version requirements are untouched; the `bevy_gaussian_splatting`
+  fork rev is unchanged (`martin-tightcut` head still matches the pinned commit). No source changes.
+- **Pinned the OLD trait solver, deliberately.** `nightly-2026-08-28` is the first pin that carries
+  rustc's [next-generation trait solver](https://blog.rust-lang.org/2026/08/21/enabling-next-solver-on-nightly/)
+  on by default (`-Znext-solver=globally`). Under it `bevy_render` 0.19.1 needs **~13.3 GB RSS in one
+  `rustc` and gets OOM-killed**, against **~1.9 GB** with the old solver — a ~7× regression that breaks
+  both the dev box and the 16 GB CI runners. `.cargo/config.toml` now sets
+  `rustflags = ["-Znext-solver=coherence"]` (the documented opt-out) until that is fixed upstream.
+  Scope checked and narrow: **martin's own crate builds clean under the new solver** (a full
+  `--release` codegen of the `martin` bin with `-Znext-solver=globally`, deps on the old solver), and
+  the bump needed no source changes here. See `CONTRIBUTING.md` § The trait solver for how to re-test.
+- **Dropped two `cargo-audit` exceptions.** The dep refresh pulled `quick-xml` 0.41.0 (via
+  `wayland-scanner`), which patches **RUSTSEC-2026-0194** and **RUSTSEC-2026-0195**, so both ignores are
+  gone from `.cargo/audit.toml` — the audit gate now passes on its own merits rather than by exemption.
+  Only the `ttf-parser` unmaintained-crate warning (RUSTSEC-2026-0192) remains ignored, as before.
 - **Batch synth ~30% faster (~3.6s → ~2.5s on the builtin score).** The parallel render was pinned by
   the single fattest lane (`L_WALL`, 12 supersaw/choir voices per bar) while other cores idled; it's now
   chunked and rendered in parallel, then summed — an exact reconstruction (verified byte-identical WAV

CLAUDE.md

@@ -77,7 +77,7 @@ build.rs     synthesizes the demo's gitignored .ply at build time; bundles asset
 > **`reuse`** — make `reuse lint` green again (classify + annotate new files). Use them for those tasks.
 
 **Nightly toolchain is required** (`bevy_gaussian_splatting` default features use GATs behind
-`nightly_generic_alias`). `rust-toolchain.toml` pins a **dated** nightly (`nightly-2026-04-26`, not
+`nightly_generic_alias`). `rust-toolchain.toml` pins a **dated** nightly (`nightly-2026-08-28`, not
 rolling `nightly`) + the `rustfmt`/`clippy` components it needs. Linux build deps: `libudev-dev
 libasound2-dev libwayland-dev libxkbcommon-dev`.
 

CONTRIBUTING.md

@@ -13,7 +13,7 @@ production). Patches welcome. This file is the short version; see **README.md**
 
 A **nightly** toolchain is required — `bevy_gaussian_splatting`'s default features use
 `nightly_generic_alias` (GATs). `rust-toolchain.toml` pins a **dated** nightly (currently
-`nightly-2026-04-26`) — deliberately **not** rolling `nightly`, so a nightly regression/ICE can't break
+`nightly-2026-08-28`) — deliberately **not** rolling `nightly`, so a nightly regression/ICE can't break
 the build before a compo; bump the date deliberately and re-verify. It also lists the `rustfmt` +
 `clippy` components the dated nightly needs (the CI fmt/clippy gates inherit this file).
 
@@ -26,6 +26,39 @@ cargo +nightly test --release         # the unit tests (parsers, timeline, score
 ./record.sh out.mp4                    # render the whole timeline to an mp4 (headless)
 ```
 
+## The trait solver (temporarily pinned to the old one)
+
+`nightly-2026-08-28` flipped rustc's [next-generation trait solver][ns] on by default
+(`-Znext-solver=globally`, [rust-lang/rust#160619][pr], announced 2026-08-21). martin currently opts
+back out in `.cargo/config.toml`:
+
+```toml
+[build]
+rustflags = ["-Znext-solver=coherence"]
+```
+
+**Why:** under the next solver, `bevy_render` 0.19.1 needs ~13.3 GB RSS in a single `rustc` and gets
+OOM-killed on a 16 GB machine; with the old solver the same crate peaks at ~1.9 GB. That ~7×
+regression breaks the dev box *and* the 16 GB GitHub runners, so it is not something we can just eat.
+
+**It is only that one dependency.** martin's own crate builds clean under the new solver (verified by
+a full `--release` codegen of the `martin` bin with deps on the old solver), and the bump needed no
+source changes here. To re-check both halves of that (env `RUSTFLAGS` overrides the config file):
+
+```bash
+# whole tree on the next solver — expect the bevy_render OOM
+RUSTFLAGS="-Znext-solver=globally" cargo build --release
+
+# just martin's own code on the next solver, deps on the old one (this is the one that should pass)
+cargo rustc --release --bin martin -- -Znext-solver=globally
+```
+
+Re-test on each toolchain bump and **drop the opt-out as soon as `bevy_render` builds in sane
+memory** — the old solver is slated for removal, so this is borrowed time, not a resting place.
+
+[ns]: https://blog.rust-lang.org/2026/08/21/enabling-next-solver-on-nightly/
+[pr]: https://github.com/rust-lang/rust/pull/160619
+
 ## Before you push
 
 CI (`.github/workflows/`) gates pull requests on these — run them locally first: