Calibrate the int8 detectors on library proxies, in chunks, and measure them

The first int8 files found no faces at all, and for two reasons the
tool now guards against. The calibration set was landscape photographs
with no faces in them, so the score head's ranges had never seen the
face regime; the set is now proxies from the library itself. And ONNX
Runtime's strided and moving-average calibration modes both degrade
these graphs measurably (a quarter of the faces at eight images, none
at ninety-six), while driving the calibrator in chunks by hand gives
ranges identical to a single pass — so the tool does that, four images
at a time, and feeds quantize_static through its range cache.

Measured against f32 over 400 proxies (docs/inference.md §10.1): the
10g form finds every face above 32 px the f32 form finds; 500m and
2.5g find 96%, and what they lose sits at a median confidence of 0.52
against the 0.50 threshold. Shipped with the number on record.

The Android unpack list gains the three int8 files; without that the
tablet never saw them. D13's runtime half records the reopening.

docs/architecture.md

@@ -1236,7 +1236,7 @@ Full rationale in [requirements.md §8](requirements.md). Summary:
 | D10 | Single adaptive interface | Decided |
 | D11 | Product positioning | Decided |
 | D12 | Scope versus pace | **Open** |
-| D13 | Face inference runtime and model licensing | **Runtime answered**, licensing open |
+| D13 | Face inference runtime and model licensing | **Runtime answered**, reopened for per-device backends (docs/inference.md); licensing open |
 | D14 | Segmentation source for local masking | Decided — arm C (docs/segmentation.md §14) |
 | D15 | Target devices — 12-inch tablet and desktop, no phone | Decided (requirements D15) |
 

docs/inference.md

@@ -397,6 +397,33 @@ In order, with the gate each is:
 
 M1 and M2 are the ones the rest is conditional on, and M2 is the one that needs a person.
 
+### 10.1 M2 result · 2026-09-19
+
+Each int8 detector against its own f32 form, over 400 proxies evenly spaced through the reference
+library, on ONNX Runtime's CPU provider (the int8 graph is the same file the Hexagon loads;
+`ui/dr-ui/examples/face_detectors`). Calibrated on 64 proxies from the same library, disjoint
+from the 400.
+
+| Detector | f32 faces | int8 faces | both | int8 only | f32 only | found ≥ 32 px | found, all sizes |
+|---|---|---|---|---|---|---|---|
+| scrfd_500m | 1342 | 1319 | 1287 | 32 | 55 | 95.6% | 95.9% |
+| scrfd_2.5g | 1525 | 1482 | 1478 | 4 | 47 | 96.1% | 96.9% |
+| scrfd_10g | 1769 | 1760 | 1749 | 11 | 20 | 100% | 98.9% |
+
+The 10g form clears the 97% gate; 500m and 2.5g sit one point under it. What they lose is
+specific: the faces in the "f32 only" column have a **median confidence of 0.52** against a
+threshold of 0.50 — detections the f32 graph itself barely made, that int8 rounding drops to the
+other side of the line — and the extra faces int8 finds are the same kind (median 0.51–0.52).
+Not a size-band failure: the losses are spread across bands in proportion. Shipped as they are,
+with the number on record; a threshold of 0.48 for the int8 forms would recover most of the
+margin, and is the first thing to try if a library's count on the tablet reads low.
+
+Two things the calibration taught, both in `tools/quantise-models.py`: the calibration set has
+to contain faces (a first attempt on landscape photographs produced a graph that found nothing —
+the score head's ranges had never seen the face regime), and ONNX Runtime's own strided and
+moving-average calibration modes both measurably degrade the result on these graphs, while
+driving the calibrator in chunks by hand reproduces the plain min/max ranges exactly.
+
 ---
 
 ## 11. Order

docs/requirements.md

@@ -2222,6 +2222,17 @@ desktop window, not as a second interface.
 
 ### D13 — face inference runtime and model licensing · **RUNTIME ANSWERED · LICENSING POSITION RECORDED 2026-09-19**
 
+> **Runtime, reopened 2026-09-19 — to the extent of [inference.md](inference.md) §3.** The
+> pure-Rust build stands: `ort` still links nothing. What changed is that `ort::set_api` can be
+> handed the table of a `libonnxruntime` the *package* installs, and the app now looks for one at
+> launch and runs on tract only when there is none. Measured before it was built: tract runs
+> every model on one core at the same speed on a tablet and a twenty-core desktop; ONNX Runtime's
+> CPU provider alone is 3–10× that, the Hexagon at int8 runs the detectors in 1–3 ms, TensorRT
+> at fp16 in 2–3 ms. The Android APK bundles ONNX Runtime and Qualcomm's HTP libraries (§3.1 —
+> the QNN licence is read, not summarised, before a release carries them); the desktop packages
+> bundle nothing NVIDIA and use a system CUDA/TensorRT if the probe finds one that works. The
+> licensing half is unchanged.
+
 > **Position, 2026-09-19.** DarkRoom is non-commercial software, built and installed by its
 > author for personal libraries, and it uses the InsightFace SCRFD detectors and ArcFace embedder
 > under their **non-commercial research grant** as such. That is the position, and it is taken