diff --git a/docs/micromate_protocol_reference.md b/docs/micromate_protocol_reference.md
index ce34348..ff07130 100644
--- a/docs/micromate_protocol_reference.md
+++ b/docs/micromate_protocol_reference.md
@@ -2067,6 +2067,80 @@ leak is reproducible and attributable to a specific UI action.
 3. **Log what changed, not what did not.**  `timed out: False` 178 times is
    noise; the five `True` entries are the signal, and they are buried.
 
+## Known-good RV55 config for a Micromate (2026-09-25)
+
+Read off a unit **deployed and working for months**.  This is the reference to
+diff a misbehaving modem against — the fastest diagnostic available, since TMI
+has seven working units and only one that misbehaves.
+
+### Serial interface — Port 1
+
+| field | value | note |
+|---|---|---|
+| Mode | **PAD** | |
+| **Baud rate** | **115200** | Micromate rate.  Series III units use **38400** — a modem moved between series needs this changed |
+| Data bits / Parity / Stop bits | 8 / None / 1 | |
+| Flow control | **None** | hardware FC blocks TX when the pins are not wired |
+
+### PAD settings — Port 1
+
+| field | value | note |
+|---|---|---|
+| PAD mode | TCP | |
+| **Listen for connections (auto-answer)** | **On** | this is what lets THOR dial *in*.  Off, and only call-home works — which would present exactly as "unreachable but it still calls home" |
+| **Listening port** | **9034** | the port THOR dials |
+| **Destination address** | **50.197.32.91** | the office public IP — where the unit calls home *to* |
+| **Destination port** | **12345** | the office ACH listener |
+| MTU | 1304 | |
+| Data forwarding timeout | 500 ms | |
+| **Idle timeout** | **2 min** | matches the value this project settled on for Series III |
+| Connect timeout | ≈1.08 min | |
+| Start only when WAN available | Off | |
+| TCP reconnect on disconnect | Off (locked) | |
+| **TCP keepalive** | **Off** | ⚠ see below |
+| Keepalive idle / interval / count | 30 s / 10 s / 3 | configured but inactive while keepalive is Off |
+
+### Cellular
+
+APN `mw01.VZWSTATIC` — Verizon's **static-IP** APN, which confirms the fleet's
+addresses are fixed and rules out any "the IP moved" explanation.  IPv4 only,
+MTU 1428, radio firmware VERIZON.
+
+### ⚠ Two things worth questioning in this config
+
+**TCP keepalive is Off.**  Nothing detects a half-open TCP session from the
+modem's side; the 2-minute **idle** timeout is the only reaper.
+
+**And an idle timer can be held open indefinitely by a client that keeps
+writing.**  THOR polls every 30 s (measured — see the polling section).  If it
+holds a session the unit has stopped answering on, and keeps writing into it,
+each write plausibly resets the modem's idle timer.  The session then never ages
+out, the PAD's single slot stays occupied, and every new inbound connection
+fails — while ACEmanager keeps answering on its own separate service.
+
+⚠ **Hypothesis.**  Whether traffic in one direction resets that timer is not
+confirmed, and the single-slot behaviour has not been tested on a real modem.
+`bridges/mm_probe.py --slots N` tests the second part directly.
+
+Turning **keepalive On** would give the modem an independent way to notice a
+dead peer, rather than depending on an idle timer a chatty client can hold open.
+That is a change to make deliberately and one modem at a time.
+
+### What to diff on a misbehaving modem
+
+In rough order of likelihood for "worked at first, then stopped":
+
+1. **Idle timeout** — 0/disabled lets a stale session hold the slot forever
+2. **Listen for connections** — Off means inbound never works, but call-home still does
+3. **Baud rate** — 115200 for Micromate, 38400 for Series III
+4. **Listening port** — must match what THOR dials
+5. **Destination address/port** — wrong here breaks call-home but *not* inbound
+6. **Data forwarding timeout** and **MTU** — affect framing, not reachability
+
+Note 2 and 5 fail in opposite directions, which is diagnostic in itself: inbound
+broken with call-home working points at the listener; call-home broken with
+inbound working points at the destination.
+
 ## Thor's conventions vs the protocol's requirements
 
 **SFM is not meant to reimplement Thor.**  Thor is the only available teacher of