verify(micromate): the uint32 chunk offset is confirmed -- 72,560 B in 71 chunks

UM20147's event 055d4a83 downloaded at exactly its promised size over USB,
exercising the carry into params[1] on chunks 64-70.  The uint32 reading was
inference for one commit; it is now evidence, and the 64 KB cap that would have
made this event unfetchable is closed.

Worth noting what the same run prices: 71 chunks x ~0.65 s is roughly 46 SECONDS
for one 72 KB histogram over cellular, against 0.2 s over USB.  That is the
round-trip cost model doing real work -- the bytes are nothing, the commands are
everything.  A unit holding several events this size is a multi-minute call, so
the untested single-request offset_hi = 0x10 streaming mode (which would collapse
a download to one round trip) moves up the list.

Docstrings and the protocol reference downgraded from "inference" to "confirmed"
only where the hardware actually settled it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ru8Lg9HkkYvX9VWWo65SmL

micromate/protocol.py

@@ -182,9 +182,12 @@ def chunk_params(key4: bytes, byte_offset: int) -> bytes:
 
     A uint32 here is **byte-identical for every offset below 65,536**, so it
     changes nothing that was verified against THOR's frames (the replay test
-    asserts all 74 of them) and extends the range to 4 GB.  Above 64 KB it is
-    **inference**: `params[0:4]` is demonstrably one 4-byte field, because chunk 0
-    puts a 4-byte key in it, but no capture exercises a carry into `params[1]`.
+    asserts all 74 of them) and extends the range to 4 GB.
+
+    ✅ **Confirmed on hardware 2026-10-01.**  UM20147's 72,560-byte event
+    downloaded in **71 chunks** at the exact promised size, which exercises the
+    carry into `params[1]` on chunks 64–70.  It was inference for one commit and
+    is now evidence.
 
     ⚠ This is the **Series III 64 KB page-boundary bug in a new guise** — there,
     `parse_strt_end_offset()` discards the key's page byte and the `5A` walk