docs(series4): 0xDA creates setup files -- confirmed on the device

TEST1.mmb did not exist on UM12947 before the push.  After it, the setup is
present in the unit's own setup list and selected as active -- verified on the
Micromate's screen, not inferred from the ack.

This was the last open question about whether Series IV setup management is
reachable without Thor.  It is: 0x41 read name, 0x1A read block, 0xDA name the
target, 0x71 -> 0x72 write it back.  No file-transfer primitive is needed and
the target file does not have to exist.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ru8Lg9HkkYvX9VWWo65SmL

docs/micromate_protocol_reference.md

@@ -843,13 +843,28 @@ Do **not** retune `_GEO_LSB_IPS` — this is corroboration, not a correction.
   near-zero payloads here and nothing in them changed, so no field is located.
   Series III maps backlight/power-save/LCD-cycle into `0x68`; unverified here.
 - **The three header bytes** at data `0x0000`/`0x0009`/`0x0013`.
-- **Whether a *new* setup file can be created**, or only an existing one
-  overwritten.  `0xDA` named a file that did not previously exist and the unit
-  accepted it — but we did not confirm on the unit's screen that `TEST1` now
-  exists as a selectable setup.  Worth checking on the device.
 - **Scheduler / call-home writes.**  `callhome.MMB` is a file too, so it may go
   through the same `0xDA` + block-write shape with a different target name.
 
+### ✅ `0xDA` CREATES setup files (confirmed on the device, 2026-09-24)
+
+`TEST1.mmb` did not exist on the unit before the push.  Afterwards it is
+**present in the unit's setup list and selected as the active config** —
+verified on the Micromate's own screen, not inferred from the ack.
+
+So the four commands below are the complete setup-management path, and a
+homebrew client needs no file-transfer primitive and no pre-existing target:
+
+```
+0x41  read the active setup's name
+0x1A  read its config block          ─┐ read
+0xDA  name the target .MMB           ─┘ modify
+0x71 → 0x72  write the block back      write  (creates the file if absent)
+```
+
+That closes the last open question about whether Series IV setup management is
+reachable from outside Thor.  It is.
+
 ## Static analysis of the firmware (2026-09-23, solo session)
 
 ### Architecture