• Parked remote climate — not doable from the head unit (live HVAC only, see control).

It needs the TBox's cloud → CAN HV-wake sequence. OBD2 is ruled out (query-only,

  isolated — see [[canbus]]). The concrete next step is a **direct listen-only tap of the internal
  TBox CAN bus**, then correlate frames against head-unit stimuli to find the HV-wake / HVAC
  signals.
* **Own 4G + always-on node** — either wake Android over USB (USB wake appears to be engineered
  in) and act via CarService, **or** put an always-on MCU directly on the CAN bus at the TBox
  connector (the architecturally-correct TBox replacement). See [[overview]].
* **Real charge-time over CAN** — the BMS may broadcast a genuine remaining-time frame the head
  unit ignores; worth looking for on a direct-CAN tap.