diff --git a/implementations/main.cpp b/implementations/main.cpp
index 793d51f..1346d43 100644
--- a/implementations/main.cpp
+++ b/implementations/main.cpp
@@ -111,12 +111,22 @@ bool g_learn = true;
 // Dump the trustlet's own log out of the response buffer after every command.
 // See DumpTaLog: on pmOS this is the ONLY way to read it.
 bool g_taLog = false;
-// How many frames one press may contribute. Stock has no explicit bound -- it
-// harvests until the finger lifts -- but a finger left resting on the sensor
-// should not grow the template without limit, and the template body has a hard
-// ceiling: it moves as a SINGLE gpfile op against a 516084-byte listener
-// buffer, and a 30-sample body already measured 386402.
-int g_learnMaxFrames = 8;
+// How many frames ONE PRESS may contribute, counting the matching frame.
+//
+// 1, and that is a correction rather than a default. At 8 it folded 185 frames
+// across one evening against a max_sub_template_num of 96, and the template
+// went from matching ten presses out of ten to failing five in a row --
+// measured 2026-09-05, four matches each followed by a save, then nothing. The
+// frames a single press contributes are near-duplicates of one image, so
+// feeding eight of them per press does not add coverage, it spends the
+// template's slots on one position and evicts the diversity the enrolment put
+// there.
+//
+// Stock's ~46 updates in a session are spread over many separate presses, which
+// is where real diversity comes from. One fold per matched press mirrors that
+// and needs no extra capture at all, because the matching frame is already in
+// the trustlet. Raise it only for a deliberate experiment.
+int g_learnMaxFrames = 1;
 
 // The namespace key the trustlet hashes into the SFS group's directory name.
 // It defaults to Android's because that is what this device's existing store
diff --git a/packaging/fplearn.sh b/packaging/fplearn.sh
index ebc4032..a7e2adc 100755
--- a/packaging/fplearn.sh
+++ b/packaging/fplearn.sh
@@ -90,7 +90,11 @@ restart() {  # $1 = extra args
     printf ' TIMED OUT\n'; return 1
 }
 
-SNAPDIR=$HOME/fp6-backups/snapshots
+# NOT $HOME: this script is run under sudo, where HOME is root's, so snapshots
+# silently landed in /root/fp6-backups and `ls ~/fp6-backups/snapshots` said
+# they did not exist. Resolve the INVOKING user's home instead.
+SNAPHOME=$(getent passwd "${SUDO_USER:-$(id -un)}" | cut -d: -f6)
+SNAPDIR=${SNAPHOME:-$HOME}/fp6-backups/snapshots
 
 case "${1:-}" in
 snapshot)
@@ -144,7 +148,7 @@ wipe)
     # taken first because a template is not reproducible without a finger.
     echo "=== wipe: every stored template ==="
     echo "before:"; sizes
-    D=$HOME/fp6-backups/$(date +%Y-%m-%d-%H%M)-pre-wipe
+    D=${SNAPHOME:-$HOME}/fp6-backups/$(date +%Y-%m-%d-%H%M)-pre-wipe
     mkdir -p "$D"
     sudo tar -cf "$D/persist-data.tar" -C /mnt/persist data
     sudo cp "$MAP" "$D/" 2>/dev/null || true