diff --git a/README.md b/README.md
index a3bdbb6..43db490 100644
--- a/README.md
+++ b/README.md
@@ -19,8 +19,8 @@ Cross-compiling for the phone:
 
 ```sh
 packaging/make-sysroot.sh
-crafter-build -- --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8.6-a+fp16fml+aes+sha3+sm4 --mtune=cortex-a720
-crafter-build test --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8.6-a+fp16fml+aes+sha3+sm4 --mtune=cortex-a720
+crafter-build -- --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8-a --mtune=generic
+crafter-build test --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8-a --mtune=generic
 ```
 
 Verified on the device: all five suites pass cross-built and run on the phone
diff --git a/packaging/actions.conf.example b/packaging/actions.conf.example
index da6ce1d..bfb6ff9 100644
--- a/packaging/actions.conf.example
+++ b/packaging/actions.conf.example
@@ -1,14 +1,19 @@
-# fingerprintd per-finger actions.
+# fingerprintd — per-finger actions.
 #
 # Install as /etc/fingerprintd/actions.conf. With no such file, a finger does
 # exactly what it always did: it unlocks.
 #
-# This file is for running root scripts on finger actions.
-# For scripts that run in your session, you can use this D-Bus:
+# YOU PROBABLY DO NOT NEED THIS FILE. Every matched finger is already
+# announced on the system bus, unconditionally and with nothing configured:
 #
 #     net.catcrafts.Fingerprintd1.FingerMatched(finger, uid)
 #     on /net/reactivated/Fprint/Device/0
 #
+# That is how a finger launches an application. An agent in your own session
+# hears the signal and decides what the finger means, from your own
+# configuration, running as you with your bus and your display. The daemon is
+# root and deliberately does not try to do that for you.
+#
 # This file is for the two things that do need the daemon.
 #
 # THIS FILE IS A ROOT SHELL. Every command here is run by root when that
@@ -33,18 +38,30 @@
 #   no-unlock  this finger never unlocks. The client is told it did not match,
 #              whatever really happened.
 #
-#   command    an absolute path, passed to /bin/sh -c with a fixed environment
-#              plus FINGERPRINTD_FINGER.
+#   command    an ABSOLUTE path, passed to /bin/sh -c with a fixed environment
+#              plus FINGERPRINTD_FINGER. Double-forked, so it may outlive the
+#              daemon and can never delay an unlock.
 #
+# At least one of the two is required. A finger listed on its own says nothing
+# the signal above does not already say.
+
 # --- A finger that also does something, as root -----------------------------
 #right-ring-finger    /usr/local/bin/toggle-something
-#
+
+# --- A finger that does not unlock ------------------------------------------
+#left-thumb           no-unlock
+
 # --- A duress finger: rejected, and the script runs anyway ------------------
 #
-# Know what this is not: It is a panic button, not deniability. The
-# rejection it fabricates is far faster than a real one. A finger the sensor
+# Think carefully before making that script destructive:
+#
+#   * a false accept that opens a camera is a shrug; one that wipes is not,
+#   * and anyone who can compel one unlock can usually compel a second.
+#
+# AND KNOW WHAT THIS IS NOT. It is a panic button, not deniability. The
+# rejection it fabricates is far faster than a real one — a finger the sensor
 # genuinely does not know takes about three seconds to be refused, this takes
-# milliseconds. The daemon's journal records that the finger really matched,
+# milliseconds — the daemon's journal records that the finger really matched,
 # this file names it in plain text, and the finger still shows as enrolled in
 # fprintd-list. It reliably runs your script. It does not reliably hide that
 # it did.
diff --git a/packaging/build-package.sh b/packaging/build-package.sh
index d93d8ca..14b45f0 100755
--- a/packaging/build-package.sh
+++ b/packaging/build-package.sh
@@ -76,18 +76,13 @@ retry "make sysroot" "$SRC/packaging/make-sysroot.sh" "$SYSROOT"
 # under ~/.cache/fingerprintd/libqcomtee-<target>, which is this script's
 # default output dir. Needs git, installed above.
 retry "make libqcomtee" "$SRC/packaging/make-libqcomtee.sh" \
-	--target=aarch64-alpine-linux-musl --sysroot="$SYSROOT" --march=armv8.6-a+fp16fml+aes+sha3+sm4
+	--target=aarch64-alpine-linux-musl --sysroot="$SYSROOT" --march=armv8-a
 
 # --- cross-compile the daemon; run the suites natively. The core is portable
 # by construction (no GLib, no libqcomtee, no system headers), which is what
 # lets the wire formats and state machines be tested on the build host at all.
 cd "$SRC"
-# The phone is one SoC, 4x Cortex-A520 + 4x Cortex-A720, so build for it (the
-# same -march goes to libqcomtee above). armv8.6-a is the highest level whose
-# mandatory set it exposes (8.7 would assume WFxT, 9.x SVE2 - neither is in
-# its hwcaps); +fp16fml+aes+sha3+sm4 are the optional extensions it has. Same
-# string as the fp6-img aports.
-XTARGET="--target=aarch64-alpine-linux-musl --sysroot=$SYSROOT --march=armv8.6-a+fp16fml+aes+sha3+sm4 --mtune=cortex-a720"
+XTARGET="--target=aarch64-alpine-linux-musl --sysroot=$SYSROOT --march=armv8-a --mtune=generic"
 crafter-build -- $XTARGET
 crafter-build -- --product=agent $XTARGET
 crafter-build test