A refused enrolment sample is one of two things: an image the algorithm saw and
turned down (rc=0, samples remaining unchanged) or an error the trustlet never
got past (a negative rc). The touch line printed the count and the fid but not
the rc, so a run of twenty-two refusals in a row said nothing about which it was.
It does now.
EXTRA=... on deploy-dev.sh appends daemon flags, so a diagnostic session can
come up with --ta-log without editing the script or the unit by hand.
Nothing is packaged yet, so the binary, the scripts, the module load, the
persist mount and the transient unit all live in places a reboot wipes. That is
deliberate -- a reboot leaves a stock phone rather than a half-installed daemon
-- but its cost was a list of manual steps in a journal handoff, and the second
reboot of the day showed what that costs. The list is now a script.
Two things it gets right that a first draft did not. The readiness check is
scoped to the current systemd invocation: the journal persists across restarts
and reboots, so grepping the whole unit history matches the previous run's ready
line and reports the daemon up while the session is still coming up on the
worker thread. And the binary is copied under a new name and swapped in with mv
after the unit stops, because a running executable cannot be overwritten and
scp reports that only as "dest open: Failure" -- which a retry loop turns into
six identical failures instead of one clear one.
Verified from a freshly rebooted phone and again over a running daemon.
