docs(series4): setups are files; and the length field is a uint16

Two findings and one correction.

CORRECTION: the probe response's data length is a uint16 BE at payload[8:10],
not a single byte at payload[9] as an earlier draft claimed. That reading is
right only while the high byte is zero. For SUB 0x1A the real length is 0x082C
= 2092; read as a byte it gives 44, a 47x under-read.

Setups are FILES, not a config block. Series III has one compliance config you
overwrite; Series IV keeps named .MMB setup files on an on-device filesystem
with a current-selection pointer -- csetup.MMB, factory.MMB, and callhome.MMB
for the call-home config. Names up to 20 chars. Filesystem primitives exist
internally (NS_ReadFile_internal / NS_WriteFile_internal / NS_SeekFile_internal)
but no generic file-transfer command is exposed on the wire, so setups are
unlikely to be pushed as raw .MMB blobs over the protocol.

SUB 0x1A reads the whole active setup in 2,092 bytes -- structurally close to
Series III's ~2,126-byte compliance block -- carrying the setup FILE NAME, all
four title note/value pairs (Location, Client, Company, General Notes), the
sensor location, and per-channel labels with units. Note LMic and SMic
(linear and sound-level microphone variants) which Series III does not have.

That is the read half of setup management, so a setup can in principle be
round-tripped. The write half has not been attempted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ru8Lg9HkkYvX9VWWo65SmL

docs/micromate_protocol_reference.md

@@ -197,7 +197,12 @@ Series III reads.
 ### The probe response carries the data length
 
 Series III hardcodes `DATA_LENGTHS` per SUB.  On the Micromate the **probe
-response tells you**, at `payload[9]`:
+response tells you**, as a **uint16 BE at `payload[8:10]`**:
+
+⚠ **Corrected 2026-09-23.**  An earlier draft read this as a single byte at
+`payload[9]`.  That is right only while the high byte is zero, and it is
+catastrophically wrong for `SUB 0x1A`, whose real length is `0x082C` = **2092**
+— read as a byte it gives **44**, a 47× under-read.  Always read the pair.
 
 | SUB | command | `payload[9]` | Series III constant |
 |---|---|---|---|
@@ -208,7 +213,7 @@ response tells you**, at `payload[9]`:
 | `0x2C` | call-home config | `0x7E` | `0x7C` ✗ **differs by 2** |
 | `0x08` | event index | `0x5A` | — |
 | `0x1E` | event header | `0x08` | — |
-| `0x1A` | compliance config | `0x2C` | — |
+| `0x1A` | compliance config | `0x082C` (2092) | — |
 | `0x0A` | waveform header | `0x00` | — (no event context) |
 | `0xFE` | full config | `0x00` | — (see note) |
 
@@ -604,6 +609,49 @@ per-sample-exact applies.
 1F                     → next key + size   (until null sentinel)
 ```
 
+## Setups are FILES, not a config block
+
+Series III has one compliance config you overwrite.  Series IV keeps **named
+setup files on an on-device filesystem**, with a pointer to the current one.
+From the firmware:
+
+```
+csetup.MMB              the current setup
+factory.MMB             Factory Default Setup File
+callhome.MMB            call-home config is a file too
+"Current Setup File:  "         "Can Not Delete Active Setup File"
+GetSelectedSetupFilePathName()  CSelectSetupFiles  CSaveSetupFile
+```
+
+Names are up to 20 characters and may contain spaces, hyphens, underscores.
+The unit's help text describes selecting, renaming and deleting them, and the
+event list records which setup file produced each event.
+
+Filesystem primitives exist internally (`NS_ReadFile_internal`,
+`NS_WriteFile_internal`, `NS_SeekFile_internal`), but **no generic
+file-transfer command is exposed on the wire** — the only file-transfer string
+is `CMD_STOP_CALLHOME_FILETRANSFER`.  So setups are unlikely to be pushed as
+raw `.MMB` blobs over the protocol.
+
+### `SUB 0x1A` reads the whole active setup — 2,092 bytes
+
+Structurally close to Series III's ~2,126-byte compliance block, and it
+carries everything a setup consists of:
+
+- **the setup file name** — `Univ of Pitt-1st Yr. Housing-Loc1 Ruskin.MMB`
+- all four title note/value pairs — `Location`, `Client`, `Company`,
+  `General Notes`, with their strings
+- the sensor location string (`Loc 1`)
+- per-channel labels *and units*: `Tran in./s.`, `Vert in./s.`,
+  `Long in./s.`, `Mic psi (L)`, `LMic psi (L)`, `SMic (A)`
+
+Note `LMic` / `SMic` — linear and sound-level microphone variants that
+Series III does not have.
+
+This is the **read half of setup management**, and it means a setup can be
+round-tripped: read the active config, modify, write it back.  The write half
+is not yet attempted.
+
 ## ⚠ Untested and unsafe-until-agreed
 
 Nothing below has been sent to a unit, and nothing should be without an