diff --git a/docs/micromate_protocol_reference.md b/docs/micromate_protocol_reference.md
index 82089db..b389601 100644
--- a/docs/micromate_protocol_reference.md
+++ b/docs/micromate_protocol_reference.md
@@ -843,13 +843,28 @@ Do **not** retune `_GEO_LSB_IPS` — this is corroboration, not a correction.
   near-zero payloads here and nothing in them changed, so no field is located.
   Series III maps backlight/power-save/LCD-cycle into `0x68`; unverified here.
 - **The three header bytes** at data `0x0000`/`0x0009`/`0x0013`.
-- **Whether a *new* setup file can be created**, or only an existing one
-  overwritten.  `0xDA` named a file that did not previously exist and the unit
-  accepted it — but we did not confirm on the unit's screen that `TEST1` now
-  exists as a selectable setup.  Worth checking on the device.
 - **Scheduler / call-home writes.**  `callhome.MMB` is a file too, so it may go
   through the same `0xDA` + block-write shape with a different target name.
 
+### ✅ `0xDA` CREATES setup files (confirmed on the device, 2026-09-24)
+
+`TEST1.mmb` did not exist on the unit before the push.  Afterwards it is
+**present in the unit's setup list and selected as the active config** —
+verified on the Micromate's own screen, not inferred from the ack.
+
+So the four commands below are the complete setup-management path, and a
+homebrew client needs no file-transfer primitive and no pre-existing target:
+
+```
+0x41  read the active setup's name
+0x1A  read its config block          ─┐ read
+0xDA  name the target .MMB           ─┘ modify
+0x71 → 0x72  write the block back      write  (creates the file if absent)
+```
+
+That closes the last open question about whether Series IV setup management is
+reachable from outside Thor.  It is.
+
 ## Static analysis of the firmware (2026-09-23, solo session)
 
 ### Architecture