docs: settings backup and first verified write (C3, C4)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U8EHjVrf5ffw1Vjn5bPGJu

docs/frisko/rx910-se21.md

@@ -9,7 +9,8 @@ unless marked otherwise.
   (whole °C; firmware v10112017 uses tenths).
 - Behind the MK01 gateway (`192.168.0.150:502`, Modbus TCP → RTU 9600 8N1). One TCP client at a
   time; a new one drops the old.
-- FC 3 read, FC 6/16 write (from MR208-PC+ docs, same vendor). Values are sign-magnitude
+- FC 3 read, FC 6 write verified 2026-10-23 (4143 8 → 9: echo OK, read-back 9 after 1 s, no
+  password needed); FC 16 per MR208-PC+ docs. Values are sign-magnitude
   integers; the baseline's "legacy wrap" decodes this. Addresses are raw (4131 is 4131).
 - `RX910-SE21-AdresyMODBUS.pdf` is the official map (~90 registers) and has no scales: take them
   from `RX910-SE21_v24062015.xml` (format, min/max). Scale is per register, not a global 0.1.

docs/roadmap.md

@@ -26,8 +26,8 @@ No behaviour change.
   is the only client, with a "release gateway" switch for the app.
 - [x] C5 Parents raise the economy temperature (CWU 4143, CO 4131) to force heating; no tariff.
 - [x] C6 Energy sources readable locally: Deye via Solarman logger, Fronius Solar API, house meter.
-- [ ] C3 Backup: read and store all editable parameters except the weekly program (read-only).
-- [ ] C4 No-op write: write the current value of 4131 back and read it, with me present.
+- [x] C3 Backup of the 14 app-editable settings: `research/frisko/settings-backup-2026-10-23.json`.
+- [x] C4 Write works: FC6 4143 8 → 9 (my request), echo OK, read-back 9 after 1 s, no password.
 
 ## Next