I know the frustration. As you indicate the currents will be the same for series or parallel configuration. With series configuration the transients will feed into the part not only through the cells and the normal BAT feed path, but also from CPCKN as it flies up with P- and the CHG driver becomes a diode into BAT. This has the potential to break the CHG driver, which you fortunately do not have, or make BAT rise suddenly which can reset the part. CPCKN will feed into BAT inside the package. Since it is a discharge event you might consider a modification of a board to separate the CHG and CPCKN from the FET and temporarily ground CPCKN to VSS and power the charge FET with a 9V battery or short it. See if the oscillation effect is changed. Be sure to make the pack safe again for charge after the test.
Since you mention UN testing you apparently have a system issue (all packs behave the same) and not a single bad unit. Your DPCKN experiment seems to confirm it is not a immediate recovery, so it would seem to be a likely reset.
1. Correct. If CHGST was low and there was a reset, VREG would fall slowly. Since CHGST is high, as soon as VREG falls to POR, it sees CHGST high and wakes up again. It may be hard to see the drop in VREG which may be in the 10's of us, but the logic will go through the wake up sequence. You should be able to see some duration of DSG off which looks like the start up time from figure 5.
You might try triggering on the falling edge of DSG and looking in detail at VREG. Note the VPOR parameter in the datasheet, it only has to dip below 2.7 to have a reset. You might also try disconnecting CHGST on a pack after it is awake before applying the 20A. See if VREG falls and it stays off, or if it is some unexpected recovery.
2. You might try connecting to BAT with a capacitor to block the DC. You can extend the range of the probe with a series resistor to change the divider ration, but this will reduce the bandwidth also.
Another approach is to try to prevent it without seeing it. You might try adding capacitance at the IC pins or moving the capacitor to the pin. This might also be good for VREG. A second inspection of your layout as you suggest could be good to check for unexpected currents through your ground, long routes to the capacitors or large loops which could couple in noise.
3. That is a good point, getting rid of the transient would make all else easier. From the cell voltage or voltage input into the IC's circuit, when you switch the current you add in a voltage V = L x dI/dt.
L is a characteristic of the cells, perhaps around 0.3uH/cell. The interconnect may add some also, but ignore it if possible.
dI is the change in current, which may be the E-load setting, or in the case of the manual short or the UN test short, as much as the cells can produce, perhaps in the 80 to 150A range.
dt for the protection event is the switching off time of the discharge FET. This will depend on the '910A DSG switching speed (which is fast), the DSG series resistor (R41), the discharge FET gate capacitance and the FET's threshold voltage.
So for 20A with 5 us switching, your voltage step might be .3x20/5 or about 1.2V, which is not too bad. The cell may not be heavily loaded and the voltage might not drop much with the load or recover, so you may see 4V to 5.2V per cell change.
If you have 100A switching with the short in the same 5us, you would have .3x100/5 or 6V step. A 4V cell may have pulled to near 0V during the short, so it recovers when the load is removed and each cell sees a momentary 9-10V step. This is harder to keep out of the inputs. The larger step with the manual short may be why the balance resistors burn. 5 us is likely faster than the switching, so transients may not be so large, but the concept applies.
To eliminate or reduce the impulse, the easiest thing to control is the dt by adjusting the series resistor R41. However too large and the FET switching is too slow - the FET can fail, usually shorted. Use a fuse in your test short if you are pushing the safe operating area of the FET.
4. Unfortunately it is all related. The signals wrap around the part. The transients are not particularly from the E-load although that may affect CPCKN and through CPCKN to the BAT pin.
5. I would expect a reset induced somehow by the SCD protection, but that would not normally line up with 1s. The oscillation time may be very significant to determine the fault that is causing the event. The SCD time selection looks like ~ 1ms and a 100 ms startup delay should give a must faster cycle. Unless your configuration changed significantly, only the OV looks like a 1s delay and it is hard to envision an OV induced by current.
ZEDE is a high impedance input and has a high 100k pull-down. Our system engineers would like to see more like 1k pull-down. If this were to trigger, the part could protect from having crossed the OCD threshold, but any oscillation should have been stopped by your DPCKN experiment, and there is no clear trigger for the ZEDE event; it still seems like a reset.
The layout may be a good place to look. You should be able to look at it with a colleague. Key items would include to be sure load current does not flow in the ground reference for the chip moving the VSS pins from each other, BAT and VREF capacitors close to the IC and away from the current path, and avoiding loops that the current could couple into.
Pins pushed below VSS can cause an IC to reset, but there is no apparent reason for it to delay from the application of the current.
Unfortunately it is a phenomena you will need to measure some fault & fix, or add/change component placement until it is fixed or you see a change which leads to a fix.