Open threads & next steps

Parked remote climate (preconditioning) — not doable from the head unit (its A/C control is live HVAC only, with no preconditioning command). The mechanism is now understood: the VCU brings the HV system up — it closes the main contactors on a charge request from the BMS or an “intelligent-charging” request from the body control module, neither of which needs the car to be in “Ready”. Cabin heat/cool then runs via the A/C module (which has a remote / timed climate mode) pulling HV through the VCU. Battery preheat is charge-linked (the parked state disables standalone battery thermal management), so cabin climate is the more directly reachable half.
Two ways to trigger it: (a) reproduce the BCM/BMS→VCU request frame on a functional bus — needs a direct tap, since the OBD-II port is firewalled from those buses; or (b) command it as a security-gated diagnostic routine over OBD-II, the same path the dealer tool uses — which needs the manufacturer's Security-Access key. Path (b) is cleaner (works with the OBD-II adapter we already have) once the key is obtained.

The car stays alive parked — it recharges its own 12 V battery from the HV pack automatically (roughly weekly), so leaving it parked for a long time will not flatten it, as long as the HV pack holds charge.

The diagnostic database is the master key — the manufacturer's ODX data (or a workshop login) holds every signal's meaning + scaling and the Security-Access key. Getting it would unlock full battery/vehicle data over OBD-II and, via a security-gated routine, likely the preconditioning above — the single highest-leverage next step. See OBD-II diagnostics and Architecture.

Own 4G + always-on node — either wake Android over USB (USB wake appears to be engineered in) and act via CarService, or put an always-on MCU directly on the CAN bus at the TBox connector (the architecturally-correct TBox replacement). See overview.

Real charge-time over CAN — the BMS may broadcast a genuine remaining-time frame the head unit ignores; worth looking for on a direct-CAN tap.