@syseng68k
...If the battery system is designed to disconnect when the voltage reaches a low limit, the contactor in the box must be energised (Normally closed contact). When the battery reaches a low enough level for the contactor to drop out, the battery becomes connected again.
If I may, I think the action you describe above (energized coil drops out on low coil voltage) to indicate the behavior of a "normally closed contact" instead describes the behavior of a "normally open contact". That is to say, the ordering description for the contactor which produces the behavior you envision as cause of trouble would be "NO". The "normal" position is the position of the contacts with the coil not energized. "Normal" for a coil device does not refer to the customary position of the contacts when the circuit is in some particular configuration which is considered the normal position when operating.
So, if the contactor is NC, it is not energized when the battery is connected to the bus. Current to lift the contactor armature is only drawn when it is commanded to break the circuit by opening the normally closed contacts. In this application a mechanical latch would be applied and either this latch or the main armature by way of auxiliary contacts, would provide what's called coil clearing. That is, the latch hold the armature up, and once latched the coil clearing removes the operation current from the coil.
Such a contactor (as I described it) cannot be reset other than manually. [There are latching relays that are electrically locked, but I don't think this one would be.] Speaking of relays, the coil current may be provided by a mechanical relay, as a very substantial current would be required to lift a 400-ampere contactor, even more so if it were a motor contactor compared to a lighting contactor.
So, when this NC contactor lifts, it breaks the circuit, latches open, and disconnects its own coil. There is no resetting this puppy without breaking the seal on the battery box. Possibly its setting permits a special charging protocol at the factory to make it serviceable again, possibly not; in any case with remaining capacity around 15 or 20%, lifting the contactor to open the circuit should be no problem (the action is very fast) for the battery in the simple case of nav lights on too long.
An internal cell fault could be a different story, however. Some of the reported data in the cases involving cell damage suggest the contactor may not have opened immediately, and possibly not at all, in at least one of these cases.
As for a design to permit irreparable battery discharge, I have made designs where considerable heating of equipment was permitted by the controls. This involved a battery of motors, in a situation of very substantial life safety hazard. The idea was to get into shortening the ultimate life of the motors, as a reasonable expense in very unusual circumstances, but to stop short of fire.
There were other changes made to the manner in which the motors operated, the type of motor, the equipment building, and the location of the motors and their controls within it. So if maximum possible energy delivery was part of this 787 design, I can see that point of view even if it cost $16k. But I think it is necessary to stop short of fire-- although where that point is, is not easy to judge, it appears.
This was also true of insulation life in motors, in the example I gave. It followed a real failure of the system, very luckily without injuries, which was not our design-- although it had been a very standard design (and so "protected" the motors in preference to the mission), excepting possibly one or two details. Well, the details were important. IIRC, mission failure resulted in the loss of the motors anyway; ditto expensive controls ($10 million worth, years ago).