diff --git a/CONTEXT.md b/CONTEXT.md
index 037f8df..a5ef181 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -1,5 +1,13 @@
 # CONTEXT.md — Project Memory
 
+> **2026-10-23 night — v0.342.0 on `main`, NOT released: the upload and CPU watch (`internal/upwatch`; operator ruling
+> 2026-10-23 19:22; felhom.eu `08` §9 [DESIGN — proposed], `audits/SPIKE-upload-watch-2026-10-23.md`).** Exact
+> per-container counters (Docker Engine API), per-app judging, explainers qBittorrent / Transmission / Plex, the
+> operator-only `app_unexplained_upload` / `app_unexplained_cpu` (+ `_cleared`; hub 0.169.0, also unreleased), the line
+> from a one-second sample of the off-site push (settings.json `upwatch`), qBittorrent's default limit (50 %, never over
+> the household's). `0.342.0-rc.1` ran on scratch 9202 (its off-site is off, so the line was seeded by hand there).
+> Open: R-1244 (release), R-1245 (limit size), R-1246 (who is told), R-1247 (active line test), R-1248 (a `tc` ceiling).
+
 > **2026-10-23 (day, later) — v0.341.0: the night leg takes a `security_fix` ladder step (D39 = B, `09` §3 decision 255,
 > R-1239; operator ruling by starting the run).** `legCandidate`: verdict `proven` OR `security_fix`, every other guard
 > unchanged and in order; log `[update-leg] <app>: security fix <ids> taken (<from> → <to>)`; `LegStep.Security`. The
diff --git a/REPORT.md b/REPORT.md
index a0ea88b..97fdbca 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -1,17 +1,27 @@
-# REPORT — v0.341.0: the night update takes a security-fix step (2026-10-23, D39 = B, `09` §3 decision 255)
+# REPORT — v0.342.0 (unreleased): the upload and CPU watch (2026-10-23 night)
 
-**What:** `legCandidate` takes `proven` OR `security_fix`; every other guard unchanged and in the same order; the leg
-names a taken security step in its log, its summary step and its summary line. Design read: `09-update-architecture.md`
-§3 decisions 13–15, 52, 255.
+Task: the weekend-night brief, Part 2 (spike → design → build, commit only). Operator ruling 2026-10-23 19:22.
+Design: felhom.eu `documentation/architecture/08-alarm-ladder.md` §9 [DESIGN — proposed]. Spike, numbers and live
+proofs: felhom.eu `documentation/audits/SPIKE-upload-watch-2026-10-23.md`. Baseline: `277e998` (0.341.0, released).
 
-**Tests** (`internal/stacks/unattended_security_test.go`, six): red-proved by four mutations — the OLD verdict line
-(taken + needs_person red), a security_fix returning before the guards (needs_person, held, stopped red), any verdict but
-unrecorded taken (unknown-verdict red), every step logged as a security fix (proven red). Held and stopped run BEFORE the
-verdict line, so the old line cannot turn them red; that is why their red-proof is a different mutation.
-`go build`, `go vet`, `go test ./...` green; `controller_gates.py --fast` OK.
+## What was built (`a9c1997`, CI run 2270 success)
 
-**Live** (felhom.eu `documentation/audits/security-lane-2026-10-23/`): on 0.340.0 the night leg skipped the drill's
-security step (`not_proven`) and a hand press took it; on 0.341.0-rc.1 the night leg logged `plex: security fix
-CVE-2026-96652,… taken` and ended `done` (second-drive copy and undo copy first). **Released:** image 0.341.0 from
-`63dcccf` (CI 2264 / #471 success); per-box floors on the three test boxes, all on 0.341.0 by 11:15:31 UTC, box walk green;
-global floor 0.341.0 / MinAgent 0.158.1 at 11:24:47 UTC on the operator's yes; per-box floors cleared.
+- `internal/upwatch`: exact per-container counters (Docker Engine API), per-app judging (upload ≥ max(5 Mbit/s, 25 % of
+  the line) for 15 min; CPU ≥ max(150 %, 50 % × cores) for 30 min), explainers qBittorrent / Transmission / Plex,
+  `app_unexplained_upload` / `app_unexplained_cpu` + `_cleared` (operator-only on hub 0.169.0), the line from a
+  one-second sample of the off-site push, qBittorrent's default limit (50 %, the household's limit always wins).
+- One line on the system settings page (the measured line), one on qBittorrent's page (the limit, while the box owns it).
+- 18 new tests; 20 mutations each seen failing (CHANGELOG lists them); the system page's four frozen Hungarian renders
+  gained one row each (diffed: nothing else moved).
+
+## Live (scratch 9202, `0.342.0-rc.1`, set by hand — never offered to a household)
+
+The limit set (19:47:42Z); a real seed judged explained (20:04:42); a CPU burner in Plex alarmed once at 30 min
+(20:07:42) and cleared once (20:25:41); a flood from inside qBittorrent hidden behind the real seed alarmed once
+(20:19:42: 65.0 Mbit/s sent, 20.0 counted) and cleared once (20:41:41); a limit changed by hand was left alone
+(20:32:42). 9202 is back on 0.341.0.
+
+## Not done / open
+
+Not released (R-1244, the operator's yes; R-1245 the limit size; R-1246 who is told). The line is a lower bound
+(R-1247); an app's API can lie (R-1248: a `tc` ceiling, measured, not built). MinAgent unchanged (0.158.1).