diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0cb5125..38f3215 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -46,6 +46,50 @@ All notable changes to seismo-relay are documented here.
   500s.  Reproduced on BE12599.  Production is unaffected: it ingests complete
   files via the watcher path and never runs this walk.
 
+- **The Micromate (Series IV) live wire protocol, reverse-engineered end to
+  end** — `docs/micromate_protocol_reference.md`.  Worked out against a bench
+  UM12947 over USB and a recording relay, with THOR driving every write so that
+  no command has ever been originated against a unit by this project.  **A
+  Micromate answers Series III command frames**, with three framing differences:
+  responses carry no leading `DLE`, `payload[1]` is `0xC5` (Blastware firmware)
+  or `0x03` (Thor firmware) rather than `0x10`, and the data length is a
+  **uint16 BE at `payload[8:10]`** — read as a single byte it under-reads
+  `SUB 0x1A` by 47x.  Read path, event chain, and `SUB 0x5A` streaming the
+  `.IDFW` file verbatim are all confirmed.
+- **Series IV setup management, fully mapped.**  `0x41` reads the active setup
+  name, `0x1A` its config block, `0xDA` names the target `.MMB`, `0x71`/`0x72`
+  write it back.  **Setups are read-modify-write** — the written block is the
+  read block, 91% byte-identical at a fixed 11-byte shift.  `0xDA` **creates**
+  files rather than only overwriting, confirmed on the unit's own screen, and an
+  overwrite is protocol-identical to a create: no handshake, no warning, and no
+  protection even over the *active* setup of a monitoring unit.
+- **The scheduler file decoded** — `\system\schedule\schedule.dat`, 260-byte
+  records carrying an action bitmask (2 start, 4 stop, 8 self-check, 16 ACH), a
+  half-hour slot (48/day), day-of-week (0 = Sunday) and a length-prefixed setup
+  name.  Verified entry-for-entry against the operator's own THOR screen.
+- **A generic file transfer addressed by full path** — `0x94`/`0x48` read,
+  `0x8D`/`0x8E` write.  This **retracts** an earlier conclusion in the same
+  document that no such command existed; that was inferred from absent firmware
+  strings and was wrong.
+- **Monitoring control and per-event delete.**  `0x96`/`0x97` start and stop as
+  on Series III, but the monitoring flag at `SUB 0x1C` `data[12]` must be tested
+  for **non-zero** (observed as both `0x0E` and `0x0C`) rather than compared to a
+  constant.  Deletion is **per-event** — `0xA8` with the event key, then `0xAA` —
+  which is safer than Series III's erase-everything.  `SUB 0x1C` also carries the
+  device clock.
+- **`bridges/mm_probe.py`** — distinguishes the four faults THOR reports
+  identically as "disconnected": refused, connect timeout (the silent-drop
+  signature of a trusted-IP whitelist), **connected but no reply** (the modem
+  answered and the unit did not), and replied.  Each verdict names what to try
+  next.  `--slots N` tests single-session modem behaviour.
+- **`bridges/mm_link.py`** — a bench stand-in for a cellular modem, with a
+  decoded timestamped log and fault injection (`blackhole`, `drop`, `delay`,
+  `onewaydev`) driven by a control file.  No pyserial; stdlib `termios` only.
+- **`scratch/mm_frame_parse.py`**, **`socat_log_split.py`** and **`fake_unit.py`**
+  — a Micromate-aware frame parser (`S3FrameParser` cannot see these responses at
+  all, since it scans for `DLE+STX`), byte-exact capture recovery from a
+  `socat -x` relay log, and a serial-port stand-in that answers as a unit.
+
 ### Changed
 
 - **Connecting to a unit no longer walks its event chain.**  `/device/events`
@@ -58,11 +102,32 @@ All notable changes to seismo-relay are documented here.
   toolbar.  Knowing whether a unit's ACH is on no longer requires reading every
   event it has stored.
 
+- **Recorded what THOR actually does on the wire**, measured rather than assumed.
+  A "status check" is **eleven commands, ~2.2 KB including TCP setup** — 18.8
+  MB/day per unit at a 10 s cadence, against ~0.2 MB/day for a `POLL` +
+  `MONITOR_STATUS` check at 60 s.  The **status interval is honoured; the
+  connection interval is not** — it sets `(status / connection) - 1` checks per
+  cycle, so equal values yield *zero* cheap checks and every connection becomes
+  the expensive one.
+- **Two THOR defects reproduced with timestamps.**  After a connection drops
+  mid-download it retries **once**, stops polling entirely and **never resumes**,
+  while displaying `Connected` for as long as it is left alone — and `Idle` for a
+  unit that is actively recording.  Separately, THOR's own log shows a
+  **subscription leak**: one logical event dispatched to a growing number of
+  handlers, **1 to 12 over ten hours** of uptime, consistent with the field
+  report that only a restart recovers it.
+- **The Micromate's USB host supports FTDI and CDC-ACM only** — no Prolific, in
+  either firmware line.  A PL2303 cable (Benfei) leaves a unit with no working
+  modem port; an FTDI cable (Sabrent) works.  Both are in circulation and
+  indistinguishable by eye — identify by `lsusb` VID, `0403` against `067b`.
+
 ### Migration
 
-**None.**  Frontend and documentation only — no codec, waveform-store or DB
-change, no schema change, and no `TOOL_VERSION` bump.  The webapp is served
-from the image, so the change appears after the next `sfm` rebuild.
+**None.**  Frontend, documentation and bench tooling only — no codec,
+waveform-store or DB change, no schema change, and no `TOOL_VERSION` bump.  The
+webapp is served from the image, so its changes appear after the next `sfm`
+rebuild.  The Series-4 work adds `docs/`, `bridges/` and `scratch/` files only;
+nothing under `sfm/`, `minimateplus/` or `micromate/` was touched.
 
 ---