From d33e2d85be50a20df86ed8f31f59868e9b858401 Mon Sep 17 00:00:00 2001 From: serversdown Date: Thu, 24 Sep 2026 18:48:17 -0400 Subject: [PATCH] docs(series4): 0xDA creates setup files -- confirmed on the device TEST1.mmb did not exist on UM12947 before the push. After it, the setup is present in the unit's own setup list and selected as active -- verified on the Micromate's screen, not inferred from the ack. This was the last open question about whether Series IV setup management is reachable without Thor. It is: 0x41 read name, 0x1A read block, 0xDA name the target, 0x71 -> 0x72 write it back. No file-transfer primitive is needed and the target file does not have to exist. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Ru8Lg9HkkYvX9VWWo65SmL --- docs/micromate_protocol_reference.md | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/docs/micromate_protocol_reference.md b/docs/micromate_protocol_reference.md index 82089db..b389601 100644 --- a/docs/micromate_protocol_reference.md +++ b/docs/micromate_protocol_reference.md @@ -843,13 +843,28 @@ Do **not** retune `_GEO_LSB_IPS` — this is corroboration, not a correction. near-zero payloads here and nothing in them changed, so no field is located. Series III maps backlight/power-save/LCD-cycle into `0x68`; unverified here. - **The three header bytes** at data `0x0000`/`0x0009`/`0x0013`. -- **Whether a *new* setup file can be created**, or only an existing one - overwritten. `0xDA` named a file that did not previously exist and the unit - accepted it — but we did not confirm on the unit's screen that `TEST1` now - exists as a selectable setup. Worth checking on the device. - **Scheduler / call-home writes.** `callhome.MMB` is a file too, so it may go through the same `0xDA` + block-write shape with a different target name. +### ✅ `0xDA` CREATES setup files (confirmed on the device, 2026-09-24) + +`TEST1.mmb` did not exist on the unit before the push. Afterwards it is +**present in the unit's setup list and selected as the active config** — +verified on the Micromate's own screen, not inferred from the ack. + +So the four commands below are the complete setup-management path, and a +homebrew client needs no file-transfer primitive and no pre-existing target: + +``` +0x41 read the active setup's name +0x1A read its config block ─┐ read +0xDA name the target .MMB ─┘ modify +0x71 → 0x72 write the block back write (creates the file if absent) +``` + +That closes the last open question about whether Series IV setup management is +reachable from outside Thor. It is. + ## Static analysis of the firmware (2026-09-23, solo session) ### Architecture