verify(micromate): the uint32 chunk offset is confirmed -- 72,560 B in 71 chunks

UM20147's event 055d4a83 downloaded at exactly its promised size over USB,
exercising the carry into params[1] on chunks 64-70.  The uint32 reading was
inference for one commit; it is now evidence, and the 64 KB cap that would have
made this event unfetchable is closed.

Worth noting what the same run prices: 71 chunks x ~0.65 s is roughly 46 SECONDS
for one 72 KB histogram over cellular, against 0.2 s over USB.  That is the
round-trip cost model doing real work -- the bytes are nothing, the commands are
everything.  A unit holding several events this size is a multi-minute call, so
the untested single-request offset_hi = 0x10 streaming mode (which would collapse
a download to one round trip) moves up the list.

Docstrings and the protocol reference downgraded from "inference" to "confirmed"
only where the hardware actually settled it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ru8Lg9HkkYvX9VWWo65SmL

docs/micromate_protocol_reference.md

@@ -1006,9 +1006,17 @@ key there. Writing the offset as a uint32 BE in the same slot is **byte-identica
 for every offset below 65,536** — so it changes nothing that was verified against
 THOR's 74 captured frames — and extends the range to 4 GB.
 
-⚠ **Above 64 KB this is inference.** No capture exercises a carry into
-`params[1]`. The field's width is established; the device's handling of a
-non-zero high byte is not.
+✅ **Confirmed on hardware 2026-10-01.** UM20147's 72,560-byte event
+(`055d4a83`) downloaded in **71 chunks** at exactly its promised size — chunks
+64–70 carry a `0x01` in `params[1]`, and the device served them without
+complaint. The field is a uint32; it was inference for one commit.
+
+🔑 **And it prices a large event over cellular.** 71 chunks × ~0.65 s ≈ **46
+seconds** for one 72 KB histogram, against 0.2 s over USB. That is the
+round-trip cost model doing real work: the bytes are nothing, the commands are
+everything. A unit holding several events this size is a multi-minute call, and
+the untested single-request `offset_hi = 0x10` streaming mode would collapse it
+to one round trip — which moves that two-minute bench test up the list.
 
 ⚠ **At offset 1 MiB `params[1]` is `0x10`**, which must be escaped on the wire as
 `10 10`. Unreachable below 64 KB, so the uint32 change is what first makes that