Service Discharge & Safe-Down (T/SOH-Aware, Logged)

Valid triggers are station command, shipping mode, RMA/storage workflow, approved cloud command, and long-press hardware button. Each event must log trigger_source, actor_id/station_id, policy_hash, and a pre-sample of VIN_PRESENT. Buttons require debounce and long-press duration; cloud commands require signature verification and monotonic log_id to prevent replay.

Read SoC_start, Vcell_min, SOH, and temperature after a rebound window if charge just ended. Below 0 °C or above policy limits, do not start; at SOH borderline, limit current or segment duration. Persist an envelope snapshot and reasons when start is refused to keep audit and procurement decisions aligned.

Use an interlock window and a cool-down timer, deduplicate by log_id with idempotent intake, and require long-press thresholds for the button. Station commands must carry a batch/work-order, and cloud triggers must include a nonce. Log preempted_by if a higher-priority event cancels an ongoing discharge to aid traceability.

Use constant current for stable thermal headroom and predictable energy metrics. Choose stepped current when enclosure heating is moderate and you need quicker completion. Use segmented with rests when thermal coupling is strong or to improve metering consistency. Always record profile in trajectory=CC|Step|Segmented and energy evidence in energy_removed_Wh.

Apply zone-based limits: cool/cold zones reduce current; hot zone forces pause; forbidden areas abort. A rapid rise (high dT_dt) escalates to pause even inside nominal limits. Persist decisions as action=derate|pause|abort with reason=T_zone|T_high_rate and resume only after temperature re-enters the safe window for a stabilization period.

After pause, require the metric that caused it to remain in the safe band for a defined dwell time, then resume at reduced current. Limit retries to a small count; if ΔSoC per attempt is below minimum benefit, exit as ineffective. Log each decision with a timestamped state-machine transition for audits.

Immediately pause, then command power-path suspend/isolate. Enforce sink-only role, disable OTG, and verify VSYS <= VBAT+Δ before resuming. Hardware should include ideal-diode or back-to-back FET. Persist vin_event, path_state, and no_backcharge=true. If the check fails, abort with reason backcharge_risk and provide a service hint.

No. During service discharge, OTG is always disabled to avoid unintended sourcing and backfeed. Apply role debounce ≥200 ms to filter flapping. Record otg_state=false and role=sink in the log. If OTG is requested by external software, reject it and add a denial entry with the current safety envelope snapshot.

Internal MOSFET/resistive paths are simple but heat locally and need strong derating. External e-load allows precise current and off-board heating but requires rated connectors and reverse-current protection. Choose based on enclosure thermal budget and connector ratings, then log path=int|ext and the chosen current ceiling tied to measured T_peak limits.

Include identity (device_id, serial, fw_version), policy_hash, trigger metadata, envelope snapshot, trajectory, interlock states (VIN_PRESENT, path_state, diode_status), energy_removed_Wh, durations, exit and reason. Add prev_hash, device signature, server signature, and clock_skew_ms so gaps, reorders, or tampering are detectable.

Use a periodic cross-check against a calibrated reference unit or shadow device. For each station, enforce an acceptance band (e.g., ±Y %). Flag metering_error_pct when exceeded, require re-run or external meter audit, and block releases until evidence is in range. Persist the reference firmware and calibration IDs in the log.

Update field names and polarity for charging_state, jeita_zone, path_state, diode_status, otg_state, and units (Wh/mWh) and soh_basis. Run A/B shadow logging before release. Procurement is limited to TI/ST/NXP/Renesas/onsemi/Microchip/Melexis, and replacements are blocked until the telemetry mapper passes verification.