diff --git a/docs/micromate_protocol_reference.md b/docs/micromate_protocol_reference.md
index 72d7f9b..5b69bcc 100644
--- a/docs/micromate_protocol_reference.md
+++ b/docs/micromate_protocol_reference.md
@@ -197,7 +197,12 @@ Series III reads.
 ### The probe response carries the data length
 
 Series III hardcodes `DATA_LENGTHS` per SUB.  On the Micromate the **probe
-response tells you**, at `payload[9]`:
+response tells you**, as a **uint16 BE at `payload[8:10]`**:
+
+⚠ **Corrected 2026-09-23.**  An earlier draft read this as a single byte at
+`payload[9]`.  That is right only while the high byte is zero, and it is
+catastrophically wrong for `SUB 0x1A`, whose real length is `0x082C` = **2092**
+— read as a byte it gives **44**, a 47× under-read.  Always read the pair.
 
 | SUB | command | `payload[9]` | Series III constant |
 |---|---|---|---|
@@ -208,7 +213,7 @@ response tells you**, at `payload[9]`:
 | `0x2C` | call-home config | `0x7E` | `0x7C` ✗ **differs by 2** |
 | `0x08` | event index | `0x5A` | — |
 | `0x1E` | event header | `0x08` | — |
-| `0x1A` | compliance config | `0x2C` | — |
+| `0x1A` | compliance config | `0x082C` (2092) | — |
 | `0x0A` | waveform header | `0x00` | — (no event context) |
 | `0xFE` | full config | `0x00` | — (see note) |
 
@@ -604,6 +609,49 @@ per-sample-exact applies.
 1F                     → next key + size   (until null sentinel)
 ```
 
+## Setups are FILES, not a config block
+
+Series III has one compliance config you overwrite.  Series IV keeps **named
+setup files on an on-device filesystem**, with a pointer to the current one.
+From the firmware:
+
+```
+csetup.MMB              the current setup
+factory.MMB             Factory Default Setup File
+callhome.MMB            call-home config is a file too
+"Current Setup File:  "         "Can Not Delete Active Setup File"
+GetSelectedSetupFilePathName()  CSelectSetupFiles  CSaveSetupFile
+```
+
+Names are up to 20 characters and may contain spaces, hyphens, underscores.
+The unit's help text describes selecting, renaming and deleting them, and the
+event list records which setup file produced each event.
+
+Filesystem primitives exist internally (`NS_ReadFile_internal`,
+`NS_WriteFile_internal`, `NS_SeekFile_internal`), but **no generic
+file-transfer command is exposed on the wire** — the only file-transfer string
+is `CMD_STOP_CALLHOME_FILETRANSFER`.  So setups are unlikely to be pushed as
+raw `.MMB` blobs over the protocol.
+
+### `SUB 0x1A` reads the whole active setup — 2,092 bytes
+
+Structurally close to Series III's ~2,126-byte compliance block, and it
+carries everything a setup consists of:
+
+- **the setup file name** — `Univ of Pitt-1st Yr. Housing-Loc1 Ruskin.MMB`
+- all four title note/value pairs — `Location`, `Client`, `Company`,
+  `General Notes`, with their strings
+- the sensor location string (`Loc 1`)
+- per-channel labels *and units*: `Tran in./s.`, `Vert in./s.`,
+  `Long in./s.`, `Mic psi (L)`, `LMic psi (L)`, `SMic (A)`
+
+Note `LMic` / `SMic` — linear and sound-level microphone variants that
+Series III does not have.
+
+This is the **read half of setup management**, and it means a setup can be
+round-tripped: read the active config, modify, write it back.  The write half
+is not yet attempted.
+
 ## ⚠ Untested and unsafe-until-agreed
 
 Nothing below has been sent to a unit, and nothing should be without an