@@ -506,6 +506,7 @@ pvbat
 pvenergytotal
 pvlib
 pvlimit
+PVONLY
 pvpower
 pvwatts
 pwindow
@@ -673,6 +674,7 @@ typecodes
 tzfile
 tzpath
 unasserted
+uncalibrated
 uncompilable
 unconfigured
 underivable
 
@@ -916,8 +916,9 @@ def inverter_record(
     Tuples become lists because validate_report() keeps only a list for a structural or
     vocabulary field: a tuple `serials` or `functions` - a module-level constant, say - would be
     silently dropped from the catalogue. A set or frozenset becomes a sorted list for the same
-    reason, sorted because string hashing is randomised per process, so list(some_set) comes out
-    in a different order after a restart and two dumps of the same hardware would diff for nothing.
+    reason, sorted by string form so that a set mixing types cannot raise and withhold the whole
+    report, and sorted because string hashing is randomised per process, so list(some_set) comes
+    out in a different order after a restart and two dumps of the same hardware would diff for nothing.
     """
     fields = {
         "inverter_type": inverter_type,
@@ -939,7 +940,7 @@ def inverter_record(
     record = {"device_id": device_id}
     for name, value in fields.items():
         if isinstance(value, (set, frozenset)):
-            value = sorted(value)
+            value = sorted(value, key=str)
         elif isinstance(value, (list, tuple)):
             value = list(value)
         elif isinstance(value, dict):
 
@@ -26,6 +26,7 @@
 import argparse
 import random
 from component_base import ComponentBase
+from coordinator import inverter_record
 from mock_base import MockBase
 from oauth_mixin import OAuthMixin
 from utils import dp2, load_apps_yaml
@@ -598,6 +599,18 @@ async def run(self, seconds, first):
         if first or settings_refresh or production_refresh or realtime_refresh:
             await self.publish_data()
 
+        # Unconditional, once per cycle and outside any one-shot gate, so a transient failure is
+        # retried rather than lost - see ComponentBase.refresh_discovery(), which owns the
+        # compare/guard loop, and never raises. Placed after the device poll and publish_data()
+        # above so it describes what this cycle actually read.
+        #
+        # Deliberately BEFORE automatic_config() below, as GivTCP's run() does: automatic_config()
+        # raises when no device qualifies as a battery inverter (a battery with no scheduler, say),
+        # and that exception leaves run() every retry. Called after it, the report would never be
+        # filed on exactly the installs whose debug dump most needs to say why. automatic_config()
+        # reads nothing this call writes, so it still runs, and still raises, exactly as before.
+        self.refresh_discovery()
+
         # Automatic configuration on first run
         if first and self.automatic:
             await self.automatic_config()
@@ -2380,6 +2393,140 @@ async def automatic_config(self):
         if len(batteries):
             self.set_arg("battery_temperature_history", f"sensor.{self.prefix}_fox_{batteries[0]}_battemperature")
 
+    def build_discovery(self):
+        """
+        Describe the discovered Fox devices for the discovery catalogue.
+
+        Reads only what automatic_config() already gathers - self.device_list, self.device_detail
+        and self.device_settings - so this adds no API calls and cannot change what Fox does.
+        Reporting is independent of self.automatic: the catalogue records what hardware is there,
+        not whether this component wired apps.yaml to it, which is what the report's own
+        "automatic" flag is for.
+
+        functions says what a device physically has ("solar", "battery"); inverter_type says
+        whether Predbat would drive it. inverter_type is "FoxCloud" - the INVERTER_DEF key
+        automatic_config() itself writes - on exactly the devices automatic_config() counts as
+        inverters: hasBattery AND function.scheduler AND a positive capacity. Any other device,
+        a PV-only one or a battery automatic_config() refuses (no scheduler, say), carries no
+        inverter_type but still shows its battery in functions, which is precisely what a dump
+        from an install whose auto-config fails needs to show. That predicate is duplicated here
+        rather than shared, because sharing it means changing automatic_config(), a control path;
+        automatic_config() is the source of truth, and a test runs it to pin this copy to it.
+
+        The inverter's rating goes through capacity_watts(), never capacity * 1000: Fox reports a
+        half-kW model's capacity truncated (a KH10.5 says 10), and capacity_watts() is what
+        restores the 500 W. For a battery device that is also the value of the _inverter_capacity
+        sensor publish_data() publishes; for a PV-only device publish_data() sets that sensor to
+        0, while the catalogue still reports the device's own rating.
+
+        stationName, stationID and moduleSN are deliberately not reported. stationName is
+        user-authored free text that can hold a street address (get_device_list()'s own sample
+        holds one), and the info container's guards - a length cap and no "@" - would let an
+        address straight into a debug dump users post publicly. Neither identifier describes the
+        hardware; a station ID, if one is ever wanted, belongs in account_ids, which is
+        pseudonymised.
+
+        No battery capacity is reported. A real batteryList mixes control units that carry no
+        capacity (bcu, ivu) with bmu entries carrying one in Wh, and publish_data() sums every
+        entry that carries one - a known live bug (GH#4919): an AIO ESS reports its one pack as
+        four bmu entries, each claiming the whole pack and all carrying the inverter's own
+        serial, so the sum is 4x the truth. Publishing it would put a knowingly-wrong battery_kwh
+        in every affected dump. Two ratings are reported instead, named for what the API returned
+        rather than as the spec's "modules", since the vendor figure is known to be wrong:
+        battery_capacity_entries, how many entries publish_data() sums, and
+        battery_capacity_serials, how many distinct batterySN those entries carry. A healthy
+        four-module stack reports four and four; four entries against one serial is the GH#4919
+        signature. Neither len(batteryList) nor the entry count alone can tell them apart - each
+        reads the same for the bug as for that healthy stack. Deliberately not gated on hasBattery:
+        a battery list on a device that says it has no battery is itself worth seeing.
+
+        Returns None when nothing has been discovered yet, which refresh_discovery() treats as
+        "nothing to report, ask again next cycle".
+        """
+        if not self.device_list:
+            return None
+
+        inverters = []
+        for device in self.device_list:
+            serial = device.get("deviceSN")
+            if not serial:
+                continue
+            detail = self.device_detail.get(serial, {}) or {}
+            has_battery = bool(detail.get("hasBattery", False))
+            has_pv = bool(detail.get("hasPV", False))
+            has_scheduler = bool((detail.get("function") or {}).get("scheduler", False))
+
+            functions = []
+            if has_pv:
+                functions.append("solar")
+            if has_battery:
+                functions.append("battery")
+
+            # "schedule" is the spec's token for a device-side scheduler; export_limit has no spec
+            # equivalent. A third-party generator this inverter meters is topology, not something
+            # the inverter can do, so it is a flag rather than a capability.
+            capabilities = []
+            if has_scheduler:
+                capabilities.append("schedule")
+            settings = self.device_settings.get(serial, {}) or {}
+            # Matched case-insensitively, as automatic_config() does when it sets hasExportLimit
+            if any(str(name).lower() == "exportlimit" for name in settings):
+                capabilities.append("export_limit")
+            flags = []
+            if detail.get("thirdPartyGen", False):
+                flags.append("third_party_gen")
+
+            info = {}
+            device_type = detail.get("deviceType")
+            if device_type:
+                info["model"] = str(device_type)
+            product_type = detail.get("productType")
+            if product_type:
+                info["product_type"] = str(product_type)
+            # Fox reports a firmware version per board; info takes only strings, so they are
+            # flattened into one, board names in sorted order - as GE Cloud's
+            # _device_info_and_ratings() does with its firmware_version dict
+            boards = [(board, detail.get(board + "Version")) for board in ("manager", "master", "slave")]
+            firmware = " ".join("{} {}".format(board, version.strip()) for board, version in boards if isinstance(version, str) and version.strip())
+            if firmware:
+                info["firmware"] = firmware
+
+            # capacity_watts() multiplies the raw field, so only a positive number reaches it -
+            # the same test drives_it applies below. Anything else drops the rating, not the report.
+            capacity = detail.get("capacity", 0)
+            capacity_is_rating = isinstance(capacity, (int, float)) and capacity > 0
+            ratings = {}
+            if capacity_is_rating:
+                ratings["inverter_w"] = self.capacity_watts(detail)
+            battery_list = detail.get("batteryList") or []
+            summed = [entry for entry in battery_list if isinstance(entry, dict) and "capacity" in entry] if isinstance(battery_list, list) else []
+            if summed:
+                ratings["battery_capacity_entries"] = len(summed)
+                ratings["battery_capacity_serials"] = len({entry.get("batterySN") for entry in summed if entry.get("batterySN")})
+
+            # automatic_config() is the source of truth for which devices are inverters Predbat
+            # drives: it configures one only when hasBattery, function.scheduler and capacity > 0
+            # all hold. Duplicated here, not shared, so this observer does not touch that control
+            # path; test_fox_build_discovery_sets_inverter_type_only_where_automatic_config_would
+            # runs the real automatic_config() to keep the two in step.
+            drives_it = has_battery and has_scheduler and capacity_is_rating
+
+            inverters.append(
+                inverter_record(
+                    "fox:{}".format(serial),
+                    inverter_type="FoxCloud" if drives_it else None,
+                    composition="direct",
+                    functions=functions,
+                    capabilities=capabilities,
+                    flags=flags,
+                    hardware_ids={"serial": serial},
+                    info=info,
+                    ratings=ratings,
+                )
+            )
+
+        return {"automatic": self.automatic, "inverters": inverters}
+
 
 async def test_write_schedule(sn, api_key, token_hash, token_expires, supabase_url, supabase_key, user_id):  # pragma: no cover
     """
 
@@ -813,6 +813,16 @@ async def encode_time_windows(self, inverter_sn, time_windows):
         first_slot = time_windows.get(1, time_windows.get(min(time_windows.keys())))
         field_length = first_slot.get("field_length", 18)  # Default to variant 1
 
+        # Never encode a current above what the inverter can deliver at its rated power (issue #5187)
+        rated_current = self.get_rated_current(inverter_sn)
+
+        def encoded_current(slot_data, key):
+            """Return a slot current as CID 103 holds it, in whole amps and no higher than the inverter's rating."""
+            current = int(slot_data.get(key, 0))
+            if rated_current is not None:
+                current = min(current, int(rated_current))
+            return str(current)
+
         fields = []
 
         if field_length == 18:
@@ -822,8 +832,8 @@ async def encode_time_windows(self, inverter_sn, time_windows):
                 slot_data = time_windows.get(slot_index, {})
 
                 # Extract fields with defaults
-                charge_current = str(int(slot_data.get("charge_current", 0)))
-                discharge_current = str(int(slot_data.get("discharge_current", 0)))
+                charge_current = encoded_current(slot_data, "charge_current")
+                discharge_current = encoded_current(slot_data, "discharge_current")
                 charge_start = slot_data.get("charge_start_time", "00:00")
                 charge_end = slot_data.get("charge_end_time", "00:00")
                 discharge_start = slot_data.get("discharge_start_time", "00:00")
@@ -839,8 +849,8 @@ async def encode_time_windows(self, inverter_sn, time_windows):
                 slot_data = time_windows.get(slot_index, {})
 
                 # Extract fields with defaults
-                charge_current = str(int(slot_data.get("charge_current", 0)))
-                discharge_current = str(int(slot_data.get("discharge_current", 0)))
+                charge_current = encoded_current(slot_data, "charge_current")
+                discharge_current = encoded_current(slot_data, "discharge_current")
                 charge_start = slot_data.get("charge_start_time", "00:00")
                 charge_end = slot_data.get("charge_end_time", "00:00")
                 discharge_start = slot_data.get("discharge_start_time", "00:00")
@@ -941,6 +951,11 @@ async def resolve_discharge_soc_floor(self, inverter_sn, target_soc):
         over-discharge SOC is never written here, leaving the battery protection floor
         where the user set it.
 
+        A recovery SOC reading at or below the over-discharge SOC, or above 100, cannot be
+        right, yet most inverters report one - 0, 1, the over-discharge SOC itself or 65521
+        (issue #5187). Such a reading is replaced by over-discharge + 1, where the inverter
+        holds the recovery SOC, and is never written back.
+
         Args:
             inverter_sn: Inverter serial number
             target_soc: Cut-off SOC Predbat wants for the discharge slot, as a percentage
@@ -952,11 +967,17 @@ async def resolve_discharge_soc_floor(self, inverter_sn, target_soc):
         # Cache only - the infrequent poll runs before the first control write, so a missing
         # value means we cannot tell where the floor is and the target is left alone
         recovery_soc = parse_cid_int(values.get(SOLIS_CID_BATTERY_RECOVERY_SOC))
+        # The inverter will not accept a recovery SOC at or below the over-discharge SOC
+        over_discharge_soc = parse_cid_int(values.get(SOLIS_CID_BATTERY_OVER_DISCHARGE_SOC))
+
+        recovery_reading = recovery_soc
+        if recovery_soc is not None and (recovery_soc > 100 or (over_discharge_soc is not None and recovery_soc <= over_discharge_soc)):
+            recovery_soc = (over_discharge_soc + 1) if over_discharge_soc is not None else None
         if recovery_soc is None or target_soc >= recovery_soc:
             return target_soc
+        if recovery_soc != recovery_reading:
+            self.log(f"Solis API: Recovery SOC on {inverter_sn} reads {recovery_reading}%, which cannot be right with over-discharge SOC at {over_discharge_soc}%, so taking it as {recovery_soc}%")
 
-        # The inverter will not accept a recovery SOC at or below the over-discharge SOC
-        over_discharge_soc = parse_cid_int(values.get(SOLIS_CID_BATTERY_OVER_DISCHARGE_SOC))
         hard_floor = (over_discharge_soc + 1) if over_discharge_soc is not None else recovery_soc
 
         wanted_recovery = max(target_soc, hard_floor)
@@ -973,6 +994,28 @@ async def resolve_discharge_soc_floor(self, inverter_sn, target_soc):
             return recovery_soc
         return target_soc
 
+    def get_rated_current(self, inverter_sn):
+        """Return the battery current the inverter can deliver at its rated power, in whole amps, or None if its size is unknown.
+
+        The rating is inverterDetail power - the sensor published as inverter_size and bound to
+        inverter_limit - converted at get_nominal_voltage(), which holds still on an LV pack.
+        Floored to whole amps so the capped value is never above the rating, and so an HV pack,
+        converted at its live voltage, does not produce a new value to write every cycle.
+        """
+        detail = self.inverter_details.get(inverter_sn, {})
+        try:
+            power = float(detail.get("power"))
+        except (ValueError, TypeError):
+            return None
+        unit = str(detail.get("powerStr") or "kW").strip().lower()
+        if unit == "kw":
+            power *= 1000.0
+        elif unit != "w":
+            return None
+        if power <= 0:
+            return None
+        return float(int(round(power / self.get_nominal_voltage(inverter_sn), 6)))
+
     async def write_time_windows_if_changed(self, inverter_sn):
         """Write charge/discharge time windows, SOC, and current to inverter, only if values changed from cache.
         Automatically handles V1 vs V2 modes and only writes registers that have changed.
@@ -1009,6 +1052,14 @@ async def write_time_windows_if_changed(self, inverter_sn):
                     current_cid = SOLIS_CID_DISCHARGE_CURRENT[slot - 1]
                     max_discharge_current_amps = min(self.cached_infos.get(inverter_sn, {}).get(current_cid, {}).get('sysCommand', {}).get('max', max_discharge_current_amps), max_discharge_current_amps)
 
+                # Then cap both at what the inverter can deliver at its rated power. CID 7224/7226 are battery limits: a
+                # 3.6kW inverter reading 100A there refused every 100A write and left its discharge slot at 0A (issue #5187)
+                rated_current = self.get_rated_current(inverter_sn)
+                if rated_current is not None and rated_current < max(max_charge_current_amps, max_discharge_current_amps):
+                    self.log(f"Solis API: Capping slot currents on {inverter_sn} at {rated_current}A, the most the inverter can deliver at its rated power")
+                    max_charge_current_amps = min(max_charge_current_amps, rated_current)
+                    max_discharge_current_amps = min(max_discharge_current_amps, rated_current)
+
                 # Prep: extract active currents from slot 1 and zero out times for disabled slots
                 # so that the two-pass write below has clean data to compare against.
                 for slot in slots_to_check: