Plan: ride through cranking, shut down at ignition off

UPS input comes from the ignition-switched socket via a 15 V PD
trigger, so input loss means cranking or ignition off. The INA219
(monitor-only) gives the battery current sign; a host service would mark
cranks, then after a grace period close the recording and power off,
with a voltage floor as backstop. Records the open hardware problem:
after poweroff the UPS keeps the board powered, so it drains and
doesn't auto-start at ignition on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/BOM.md

@@ -71,6 +71,7 @@ type: reference
 
 - First read-only check (2026-10-09, on input power, charged): bus 12.34 V, shunt ≈ 0 mV (idle). Chip at power-on defaults (config `0x399f`,
   calibration unprogrammed), so read current from the **shunt-voltage register** (0x01, 10 µV/LSB) rather than the current register.
+- Fed from the ignition-switched cigarette socket via a **15 V PD trigger** (15 V / 3 A, inside the 15–19 V rating). Plan: [car power](impl/plans/POWER.md).
 - Ignition-off shutdown (not built yet): on input loss the battery current turns clearly negative (discharging). A small service watches the
   INA219, waits out a grace period longer than a crank (30–60 s), then runs `systemctl poweroff`, with low battery voltage as a hard backstop.
   The shunt value is unconfirmed; check the schematic before converting shunt mV to amps.

docs/impl/plans/POWER.md

@@ -0,0 +1,53 @@
+---
+type: plan
+status: active
+updated: 2026-10-09
+---
+# Car Power: Ride Through Cranking, Shut Down at Ignition Off
+
+## Power chain
+
+```
+cigarette socket (ignition-switched, 65 W class, crank-sensitive)
+  → USB-C PD charger → 15 V PD trigger (15 V / 3 A) → DC jack
+  → Waveshare UPS Power Module (C), 3S 21700, 15–19 V in, pass-through
+  → Orin Nano carrier
+```
+
+Socket power is ignition-switched, so **UPS input loss = ignition off or cranking**. The UPS rides through cranking
+(bench: ≥ 20 s holdover across a supply swap). See [BOM](../../BOM.md#waveshare-ups-power-module-c).
+
+## Detection
+
+INA219 on I²C bus 7, `0x41`, monitor-only (the UPS has no control lines). Battery current from the shunt-voltage register (0x01, 10 µV/LSB):
+about 0 or positive (charging) with input present, **clearly negative** (discharging) when input is lost. Battery voltage (0x02) is the backstop.
+To confirm on the bench: the sign convention and the discharge magnitude at the Orin's real load (pull the UPS input and read).
+
+## Policy (to build)
+
+A small host service polling the INA219 about every 1 s:
+
+| State | Condition | Action |
+|---|---|---|
+| on input | current ≥ about 0 | nothing |
+| on battery | discharging, < grace | publish `system/power` "on battery"; **a short episode that recovers is a crank**: stamp it into the recording |
+| ignition off | discharging continuously for grace (start at 60 s; tune after the car crank test) | publish "shutting down" → stop capture (close the session cleanly) → optional parked-at-home step → `systemctl poweroff` |
+| battery low | voltage below a floor (around 10.5 V for 3S, to confirm), at any time | `systemctl poweroff` immediately |
+
+Optional parked-at-home step: if home WiFi/LAN is reachable at ignition off, stay up long enough to copy recordings off over the LAN
+(same LAN-only rule as map sync, project-yukart decision 10), within a hard time cap, then shut down.
+
+## Open: getting the Orin back on at ignition on
+
+After `poweroff` the UPS keeps supplying the board from its battery:
+
+1. **Standby drain:** the halted Orin still draws some power, so the pack drains while parked, until the UPS's over-discharge protection cuts out.
+2. **No auto-start:** the dev kit powers on when power *appears*. If the UPS output never dropped, ignition on doesn't boot the Orin.
+
+Candidate fixes (hardware, to evaluate):
+
+- Cut the UPS output after shutdown (a latching relay or a timer on the output), so the next ignition-on is a real power-up.
+- Pulse the carrier's power-button header from a small circuit when socket power returns.
+- Suspend (SC7) instead of poweroff, with wake on a GPIO tied to socket power. Untested on this board, and still drains.
+
+Until this is solved, ignition-off shutdown leaves the car unit off until someone power-cycles it.