Reading the right places in the documentation helps a lot! In general parameters are made permanent in NV RAM with the WR command. I had confused this function with the AC command. But WR does not work for NJ node joining.
So how does XCTU make this permanent? It does. I have done it repeatedly.
More fundamentally I still want my target system to set the NJ parameter to 00 if it is anything else and make it permanent. We under rare circumstances will make it something else for a short duration to set up an new network in a controlled environment but does not allow joining otherwise. I would like that protection from power up.
I can use XCTU but it is too easy for a device to slip by where this parameter is not set to 00 in NV.