====== Open threads & next steps ======

  * **Parked remote climate (preconditioning)** — //not// doable from the head unit (its A/C control is live HVAC only, with no preconditioning command). The mechanism is now understood: the **VCU** brings the HV system up — it closes the main contactors on a **charge request from the BMS** or an **"intelligent-charging" request from the body control module**, //neither of which needs the car to be in "Ready"//. Cabin heat/cool then runs via the A/C module (which has a **remote / timed climate mode**) pulling HV through the VCU. Battery preheat is charge-linked (the parked state disables standalone battery thermal management), so **cabin climate is the more directly reachable half**.\\ Two ways to trigger it: **(a)** reproduce the BCM/BMS→VCU request frame on a **functional bus** — needs a direct tap, since the [[obd2|OBD-II port]] is firewalled from those buses; or **(b)** command it as a **security-gated diagnostic routine over OBD-II**, the same path the dealer tool uses — which needs the manufacturer's **Security-Access key**. Path (b) is cleaner (works with the OBD-II adapter we already have) once the key is obtained.
  * **The car stays alive parked** — it recharges its own 12 V battery from the HV pack automatically (roughly weekly), so leaving it parked for a long time will not flatten it, as long as the HV pack holds charge.
  * **The diagnostic database is the master key** — the manufacturer's **ODX** data (or a workshop login) holds every signal's meaning + scaling //and// the Security-Access key. Getting it would unlock full battery/vehicle data over OBD-II and, via a security-gated routine, likely the preconditioning above — the single highest-leverage next step. See [[obd2|OBD-II diagnostics]] and [[architecture|Architecture]].
  * **Own 4G + always-on node** — either wake Android over USB (USB wake appears to be engineered in) and act via CarService, **or** put an always-on MCU directly on the CAN bus at the TBox connector (the architecturally-correct TBox replacement). See [[overview]].
  * **Real charge-time over CAN** — the BMS may broadcast a genuine remaining-time frame the head unit ignores; worth looking for on a direct-CAN tap.