v0.342.0 (unreleased): the upload and CPU watch — an app that sends or burns far more than its own numbers explain is one operator-only alarm; the line learnt from the off-site push; qBittorrent's default upload limit (never over the household's)

internal/upwatch: exact per-container counters from the Docker Engine API, per-app judging (upload >= max(5 Mbit/s,
25% of the line) for 15 min; CPU >= max(150%, 50% x cores) for 30 min), explainers qBittorrent / Transmission / Plex,
app_unexplained_upload / app_unexplained_cpu + _cleared (hub 0.169.0). The off-site push is sampled once a second
for the line (a lower bound). qBittorrent limit = 50% of the line, the household's limit always wins. 20 red-proofs.
Spike + design: felhom.eu audits/SPIKE-upload-watch-2026-10-23.md, architecture/08 section 9. Not released.

controller/README.md

@@ -3524,6 +3524,18 @@ no key into the household's account). Code: `internal/stacks/after_unclean_boot.
 - **Plex:** the claim code is an `after_start` field — asked on the Plex page once Plex runs (`POST /apps/plex/plex-claim`);
   the gate opens only when Plex says claimed, and „Kész" is refused before that.
 
+### 8e. The upload and CPU watch (v0.342.0, unreleased; felhom.eu `08` §9 [DESIGN — proposed])
+
+Once a minute `internal/upwatch` reads every app container's exact sent bytes and CPU time (Docker Engine API), adds them
+up per app and, when an app sends a lot or burns CPU for a long time, asks the app itself whether that is its work:
+qBittorrent's and Transmission's own upload counters, Plex's playing and transcoding sessions. Explained → normal use.
+Not explained → one operator-only event (`app_unexplained_upload` / `app_unexplained_cpu`) and a clear when it stops.
+Numbers: upload ≥ max(5 Mbit/s, 25 % of the line) for 15 min; CPU ≥ max(150 %, 50 % × cores) for 30 min; an app with no
+explainer only at ≥ 10 × its own p95 for an hour, after ~20 h of history. The upload line is learnt from the nightly
+off-site push (one-second samples of the controller's own counter; best 10 s; a lower bound) and shown on the system
+settings page. qBittorrent gets a default upload limit of 50 % of that line (never over a household's own limit), and its
+page says so in one line. State: settings.json `upwatch`. Spike: felhom.eu `audits/SPIKE-upload-watch-2026-10-23.md`.
+
 ### 8d. Storage that knows its physical disks — the internal place, partitions (v0.317.0 build A, v0.318.0 build B)
 
 Design: felhom.eu `architecture/16-storage-physical-identity.md`. The host agent decides which physical disk a place sits on;