docs(changelog): Series-4 live protocol, THOR behaviour, and bench tooling

Written on dev as part of finishing the merge, per the repo convention, and
folded into the existing Unreleased sections rather than adding duplicates.

Added: the Micromate wire protocol (framing divergences, read path, event chain,
0x5A verbatim file streaming), setup management as read-modify-write with 0xDA
creating files, the decoded scheduler file, the path-addressed file transfer that
retracts an earlier "no such command" conclusion, monitoring control and
per-event delete, and four new tools -- mm_probe, mm_link, mm_frame_parse,
socat_log_split and fake_unit.

Changed: what THOR actually does on the wire (eleven-command status check, ~2.2 KB
a time, 18.8 MB/day/unit at 10 s), the connection interval setting a count rather
than a period, two reproduced THOR defects (silent poll death with a false
"Connected", and a subscription leak growing 1 -> 12 handlers over ten hours), and
the Micromate USB host supporting FTDI and CDC-ACM but not Prolific.

Migration extended to state the operational consequence for the whole section:
none.  No codec, store, DB or TOOL_VERSION change; the Series-4 work touches only
docs/, bridges/ and scratch/.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ru8Lg9HkkYvX9VWWo65SmL

CHANGELOG.md

@@ -46,6 +46,50 @@ All notable changes to seismo-relay are documented here.
   500s.  Reproduced on BE12599.  Production is unaffected: it ingests complete
   files via the watcher path and never runs this walk.
 
+- **The Micromate (Series IV) live wire protocol, reverse-engineered end to
+  end** — `docs/micromate_protocol_reference.md`.  Worked out against a bench
+  UM12947 over USB and a recording relay, with THOR driving every write so that
+  no command has ever been originated against a unit by this project.  **A
+  Micromate answers Series III command frames**, with three framing differences:
+  responses carry no leading `DLE`, `payload[1]` is `0xC5` (Blastware firmware)
+  or `0x03` (Thor firmware) rather than `0x10`, and the data length is a
+  **uint16 BE at `payload[8:10]`** — read as a single byte it under-reads
+  `SUB 0x1A` by 47x.  Read path, event chain, and `SUB 0x5A` streaming the
+  `.IDFW` file verbatim are all confirmed.
+- **Series IV setup management, fully mapped.**  `0x41` reads the active setup
+  name, `0x1A` its config block, `0xDA` names the target `.MMB`, `0x71`/`0x72`
+  write it back.  **Setups are read-modify-write** — the written block is the
+  read block, 91% byte-identical at a fixed 11-byte shift.  `0xDA` **creates**
+  files rather than only overwriting, confirmed on the unit's own screen, and an
+  overwrite is protocol-identical to a create: no handshake, no warning, and no
+  protection even over the *active* setup of a monitoring unit.
+- **The scheduler file decoded** — `\system\schedule\schedule.dat`, 260-byte
+  records carrying an action bitmask (2 start, 4 stop, 8 self-check, 16 ACH), a
+  half-hour slot (48/day), day-of-week (0 = Sunday) and a length-prefixed setup
+  name.  Verified entry-for-entry against the operator's own THOR screen.
+- **A generic file transfer addressed by full path** — `0x94`/`0x48` read,
+  `0x8D`/`0x8E` write.  This **retracts** an earlier conclusion in the same
+  document that no such command existed; that was inferred from absent firmware
+  strings and was wrong.
+- **Monitoring control and per-event delete.**  `0x96`/`0x97` start and stop as
+  on Series III, but the monitoring flag at `SUB 0x1C` `data[12]` must be tested
+  for **non-zero** (observed as both `0x0E` and `0x0C`) rather than compared to a
+  constant.  Deletion is **per-event** — `0xA8` with the event key, then `0xAA` —
+  which is safer than Series III's erase-everything.  `SUB 0x1C` also carries the
+  device clock.
+- **`bridges/mm_probe.py`** — distinguishes the four faults THOR reports
+  identically as "disconnected": refused, connect timeout (the silent-drop
+  signature of a trusted-IP whitelist), **connected but no reply** (the modem
+  answered and the unit did not), and replied.  Each verdict names what to try
+  next.  `--slots N` tests single-session modem behaviour.
+- **`bridges/mm_link.py`** — a bench stand-in for a cellular modem, with a
+  decoded timestamped log and fault injection (`blackhole`, `drop`, `delay`,
+  `onewaydev`) driven by a control file.  No pyserial; stdlib `termios` only.
+- **`scratch/mm_frame_parse.py`**, **`socat_log_split.py`** and **`fake_unit.py`**
+  — a Micromate-aware frame parser (`S3FrameParser` cannot see these responses at
+  all, since it scans for `DLE+STX`), byte-exact capture recovery from a
+  `socat -x` relay log, and a serial-port stand-in that answers as a unit.
+
 ### Changed
 
 - **Connecting to a unit no longer walks its event chain.**  `/device/events`
@@ -58,11 +102,32 @@ All notable changes to seismo-relay are documented here.
   toolbar.  Knowing whether a unit's ACH is on no longer requires reading every
   event it has stored.
 
+- **Recorded what THOR actually does on the wire**, measured rather than assumed.
+  A "status check" is **eleven commands, ~2.2 KB including TCP setup** — 18.8
+  MB/day per unit at a 10 s cadence, against ~0.2 MB/day for a `POLL` +
+  `MONITOR_STATUS` check at 60 s.  The **status interval is honoured; the
+  connection interval is not** — it sets `(status / connection) - 1` checks per
+  cycle, so equal values yield *zero* cheap checks and every connection becomes
+  the expensive one.
+- **Two THOR defects reproduced with timestamps.**  After a connection drops
+  mid-download it retries **once**, stops polling entirely and **never resumes**,
+  while displaying `Connected` for as long as it is left alone — and `Idle` for a
+  unit that is actively recording.  Separately, THOR's own log shows a
+  **subscription leak**: one logical event dispatched to a growing number of
+  handlers, **1 to 12 over ten hours** of uptime, consistent with the field
+  report that only a restart recovers it.
+- **The Micromate's USB host supports FTDI and CDC-ACM only** — no Prolific, in
+  either firmware line.  A PL2303 cable (Benfei) leaves a unit with no working
+  modem port; an FTDI cable (Sabrent) works.  Both are in circulation and
+  indistinguishable by eye — identify by `lsusb` VID, `0403` against `067b`.
+
 ### Migration
 
-**None.**  Frontend and documentation only — no codec, waveform-store or DB
-change, no schema change, and no `TOOL_VERSION` bump.  The webapp is served
-from the image, so the change appears after the next `sfm` rebuild.
+**None.**  Frontend, documentation and bench tooling only — no codec,
+waveform-store or DB change, no schema change, and no `TOOL_VERSION` bump.  The
+webapp is served from the image, so its changes appear after the next `sfm`
+rebuild.  The Series-4 work adds `docs/`, `bridges/` and `scratch/` files only;
+nothing under `sfm/`, `minimateplus/` or `micromate/` was touched.
 
 ---