Start the inference engine from both apps and show its choice in Settings

The desktop names where a package may have put libonnxruntime — an
override variable, beside the executable, the package's own library
directory, the Flatpak prefix, the system library directory — and
Android points at the APK's native library directory, which is also
what Qualcomm's DSP loader must be told for the Hexagon skel. Android
starts the engine at the end of the model unpack rather than at launch,
because the probe fingerprints the model files and a first launch has
none until then.

The About panel gains an Inference row beside Graphics, re-read every
two seconds while the probe runs and engines land, and faces.model_id
carries the detector's form: an int8 detector finds a different set of
faces and is a different population (docs/inference.md §7). A
low-memory signal drops every idle session with the GPU caches.

The APK assembly bundles ONNX Runtime and the Qualcomm HTP libraries
from Maven, fetched by tools/fetch-android-runtime.sh with their
published checksums; RUNTIME_DIR=none builds the tract-only APK, which
is a slower app and not a broken one. The desktop packages carry no
runtime yet.

Two probe fixes from the first desktop run: the floor must not be
built with CPU fallback disabled, and a versioned libonnxruntime.so is
a runtime too. On the reference desktop the probe now loads ONNX
Runtime 1.30, measures 30 ms on the CPU provider, and selects TensorRT
at 1.5 ms.

core/dr-inference-engine/src/api.rs

@@ -38,10 +38,16 @@ pub fn runtime() -> Runtime {
 }
 
 /// Install a table if none is installed yet — tract, since no directories
-/// were named. What a test or an example gets.
+/// were named. What a test or an example gets, unless `DARKROOM_ORT_DIR`
+/// names a runtime: the same variable the desktop honours, so an example
+/// can be pointed at the runtime the app uses without learning `init`.
 pub fn ensure_installed() {
     if RUNTIME.get().is_none() {
-        install(&[]);
+        let dirs: Vec<PathBuf> = std::env::var_os("DARKROOM_ORT_DIR")
+            .map(PathBuf::from)
+            .into_iter()
+            .collect();
+        install(&dirs);
     }
 }
 
@@ -93,11 +99,7 @@ fn load_native(dir: &std::path::Path) -> Result<Runtime, String> {
     let path = if dir.as_os_str().is_empty() {
         PathBuf::from(name)
     } else {
-        let p = dir.join(name);
-        if !p.is_file() {
-            return Err("not present".into());
-        }
-        p
+        find_library(dir, name).ok_or("not present")?
     };
 
     // SAFETY: the library's initialisers are ONNX Runtime's own; the symbol
@@ -140,3 +142,28 @@ fn load_native(dir: &std::path::Path) -> Result<Runtime, String> {
         Ok(Runtime::OnnxRuntime { path, version })
     }
 }
+
+/// `libonnxruntime.so` in `dir`, or a versioned spelling of it —
+/// `libonnxruntime.so.1.30.0` is what the Python wheel ships, and a package
+/// that installs only the versioned file is not wrong.
+#[cfg(feature = "native")]
+fn find_library(dir: &std::path::Path, name: &str) -> Option<PathBuf> {
+    let exact = dir.join(name);
+    if exact.is_file() {
+        return Some(exact);
+    }
+    let prefix = format!("{name}.");
+    let mut versioned: Vec<PathBuf> = std::fs::read_dir(dir)
+        .ok()?
+        .filter_map(|e| e.ok())
+        .map(|e| e.path())
+        .filter(|p| {
+            p.is_file()
+                && p.file_name()
+                    .and_then(|n| n.to_str())
+                    .is_some_and(|n| n.starts_with(&prefix))
+        })
+        .collect();
+    versioned.sort();
+    versioned.pop()
+}

core/dr-inference-engine/src/engines.rs

@@ -10,6 +10,11 @@ use std::path::PathBuf;
 
 use crate::{state, Config, Form, Rung};
 
+enum Source {
+    File(PathBuf),
+    Bytes(&'static [u8]),
+}
+
 /// 64-bit FNV-1a. A cache key, not a checksum: two model files that collide
 /// here would have to also be the same size and the same role, and the cost
 /// of that is a rebuilt engine.
@@ -47,34 +52,42 @@ pub fn run() {
 
     // Smallest first, so the detector — the one that runs per image — is
     // ready soonest (§6 step 3).
-    let mut jobs: Vec<(crate::Role, PathBuf, u64)> = cfg
+    let mut jobs: Vec<(crate::Role, Source, u64)> = cfg
         .models
         .iter()
-        .filter(|(role, _)| rung.form(*role) != Form::F32 || rung != Rung::Hexagon)
         .filter_map(|(role, path)| {
             let (path, form) = crate::resolve_model(*role, path);
             (form == rung.form(*role)).then(|| {
                 let size = std::fs::metadata(&path).map(|m| m.len()).unwrap_or(0);
-                (*role, path, size)
+                (*role, Source::File(path), size)
             })
         })
+        .chain(cfg.embedded.iter().filter_map(|(role, bytes)| {
+            // An embedded model has no int8 sibling to offer a rung that
+            // wants one; it runs on that rung's fallback.
+            (rung.form(*role) == Form::F32).then_some((
+                *role,
+                Source::Bytes(bytes),
+                bytes.len() as u64,
+            ))
+        }))
         .collect();
     jobs.sort_by_key(|j| j.2);
     state().lock().unwrap().wanted = jobs.len();
 
-    for (role, path, _) in jobs {
-        let Ok(bytes) = std::fs::read(&path) else {
-            continue;
+    for (role, source, _) in jobs {
+        let (bytes, name) = match &source {
+            Source::File(path) => match std::fs::read(path) {
+                Ok(b) => (b, path.display().to_string()),
+                Err(_) => continue,
+            },
+            Source::Bytes(b) => (b.to_vec(), format!("embedded {role:?}")),
         };
         let key = key(rung, &bytes);
         if state().lock().unwrap().cache.compiled.contains(&key) {
             continue;
         }
-        log::info!(
-            "inference: compiling {} for {}",
-            path.display(),
-            rung.label()
-        );
+        log::info!("inference: compiling {name} for {}", rung.label());
         let started = std::time::Instant::now();
         match crate::session::build(rung, role, &bytes, &cfg, false) {
             Ok(session) => {
@@ -83,8 +96,7 @@ pub fn run() {
                 s.cache.compiled.insert(key);
                 crate::probe::write_cache(&s.config, &s.cache);
                 log::info!(
-                    "inference: {} ready on {} in {:.1} s",
-                    path.display(),
+                    "inference: {name} ready on {} in {:.1} s",
                     rung.label(),
                     started.elapsed().as_secs_f64()
                 );
@@ -94,8 +106,7 @@ pub fn run() {
                 // their engine. A corrected model file changes the hash and
                 // is retried.
                 log::warn!(
-                    "inference: {} will not compile for {}: {e}",
-                    path.display(),
+                    "inference: {name} will not compile for {}: {e}",
                     rung.label()
                 );
             }

core/dr-inference-engine/src/lib.rs

@@ -35,6 +35,10 @@ pub enum Role {
     Embedder,
     Segmenter,
     Scene,
+    /// The dense landmark model behind the eye reading (docs/faces.md §7c).
+    Landmarks,
+    /// The eye-state and sunglasses classifiers, a few hundred kilobytes.
+    EyeClassifier,
 }
 
 /// Which numeric form of a model a session was built from.
@@ -114,6 +118,8 @@ pub struct Config {
     /// The canonical model files on this device, so engines can be compiled
     /// ahead of the first request for them.
     pub models: Vec<(Role, PathBuf)>,
+    /// Models compiled into the binary, for the same reason.
+    pub embedded: Vec<(Role, &'static [u8])>,
     /// The highest rung the user allows; `None` is "the best that works".
     pub ceiling: Option<Rung>,
     /// ONNX Runtime's intra-op pool; 0 picks from the core count.

core/dr-inference-engine/src/probe.rs

@@ -201,6 +201,12 @@ fn fingerprint(runtime: &Runtime, cfg: &Config) -> String {
         },
         device_identity(),
     ];
+    for (role, bytes) in &cfg.embedded {
+        parts.push(format!(
+            "{role:?} embedded {:016x}",
+            crate::engines::hash(bytes)
+        ));
+    }
     for (role, path) in &cfg.models {
         let hash = std::fs::read(path)
             .map(|b| crate::engines::hash(&b))

core/dr-inference-engine/src/session.rs

@@ -20,7 +20,7 @@ pub fn build(
     let mut b = Session::builder()?
         .with_optimization_level(GraphOptimizationLevel::Level3)?
         .with_intra_threads(threads(cfg))?;
-    if strict {
+    if strict && rung != Rung::Cpu {
         b = b.with_config_entry("session.disable_cpu_ep_fallback", "1")?;
     }
     // A Hexagon session loads the compiled context when there is one and