Make tongue-out stage 3 actually reach users: ship its model, stop latching failed init

[guyiome]

Summary

Two separate defects, both found by plugging in a new test device (nubia NX809J, Android 16) running the published v0.3.1.

1. The model was in no published APK

Both models are gitignored, and all three workflows only downloaded face_landmarker.task. image_embedder.tflite was therefore absent from every release, so stage 3 of tongue-out detection (points 15/56) could never initialise for anyone installing from GitHub Releases. It only ever worked on locally built APKs, where the model is present from the manual download the README documents.

Confirmed on device against v0.3.1: "Impossible d'initialiser le modèle de détection de langue tirée (CPU et GPU en échec)" — both delegates failing is exactly what a missing asset looks like.

Why it went unnoticed: the feature is opt-in and its failure is caught cleanly (logged, no crash). Point 56 recorded it as shipped and device-confirmed, which was true of local debug builds but never of the artifact users install.

release.yml and ci.yml now download both models — CI too, so the CI build stays identical to the published one and a future packaging problem surfaces on a PR rather than at release time. codeql.yml deliberately keeps fetching only the first: it compiles for analysis, where a runtime asset changes nothing. That asymmetry is commented in both files so it isn't "fixed" later by mistake.

The URL was checked rather than copied on faith: HTTP 200, 4 117 670 bytes — byte-for-byte the size of the local model already known to work. Expect the published APK to grow by ~4 MB.

2. A failed init was latched and reported as a success

The device logs showed a failure warning and TongueEmbeddingHelper initialisé at the same millisecond. ensureTongueEmbeddingHelper() assigned the instance whatever happened and logged success unconditionally — and since its own entry guard is if (tongueEmbeddingHelper != null) return, a failed setup was latched for the whole process lifetime: toggling the experimental setting off and on never retried.

setup() now returns a Boolean (single caller, no test depended on its signature; signalling failure only through onError left the caller unable to tell). The field is set only on success, the failed instance is closed, and the success log moved after the check.

Test plan

• testDebugUnitTest, assembleDebug, lintDebug green. The 3 extra lint warnings versus two weeks ago are all "a newer version is available" (CameraX 1.6.2, compose-bom 2026.09.00, ARCore 1.56.0, Kotlin plugins 2.4.20), none from this change — the only warning on the touched files, EmptySuperCall, predates it.
• Not yet verified on device, and deliberately so: a local build bundles the model anyway, so it would only exercise fix 2. Fix 1 can only be proven by a rebuilt release — hence the v0.3.2 to follow.

🤖 Generated with Claude Code