README: what real use taught about the verify loop, and the revert

README.md

@@ -109,12 +109,22 @@ the shipped config sets `max_authentication_rescan_times` to 0, because at the
 stock budget a wrong finger never yields a terminal frame and a PAM client
 waits forever for the `verify-no-match` it needs.
 
+**Known about the loop, from real use.** A verify frame is four QTEE round
+trips (~200 ms idle); a `REPORT_EVENT` that runs the matcher is ~300 ms, and
+the rising edge pays it twice because events 5 and 7 both reach the matcher.
+The first frame of a press is the finger landing and usually rejects; matches
+land at frame 3, 5, 8 — so a quick tap is often a miss. Two attempts to fix
+that (drop event 5; recapture after 50 ms) went in together and produced zero
+matches; both are reverted and recorded. gpio75 is a ~1 ms pulse, not a
+level — an IRQ-driven idle needs GPIO edge events. Changes to this loop are
+made one variable at a time, on a measured baseline.
+
 **Not done:** packaging (`provides="fprintd=…"` so this replaces the fprintd
 daemon package while `fprintd-pam` stays), the shipped storage policy, polkit
 (a caller-uid rule stands in), trustlet-side template removal (deletes drop the
-name only), cleanup when a claiming client vanishes from the bus, and the
+name only), and the kernel config change — `CONFIG_QCOMTEE`, which selects the
-kernel config change — `CONFIG_QCOMTEE`, which selects the SHM bridge — that
+SHM bridge — that gates any public image. A claim held by a client that leaves
-gates any public image.
+the bus is dropped.
 
 ## Runtime dependencies, not carried here