v0.342.0 (unreleased): the upload and CPU watch — an app that sends or burns far more than its own numbers explain is one operator-only alarm; the line learnt from the off-site push; qBittorrent's default upload limit (never over the household's)

internal/upwatch: exact per-container counters from the Docker Engine API, per-app judging (upload >= max(5 Mbit/s,
25% of the line) for 15 min; CPU >= max(150%, 50% x cores) for 30 min), explainers qBittorrent / Transmission / Plex,
app_unexplained_upload / app_unexplained_cpu + _cleared (hub 0.169.0). The off-site push is sampled once a second
for the line (a lower bound). qBittorrent limit = 50% of the line, the household's limit always wins. 20 red-proofs.
Spike + design: felhom.eu audits/SPIKE-upload-watch-2026-10-23.md, architecture/08 section 9. Not released.

controller/internal/backup/backup.go

@@ -106,6 +106,8 @@ type Manager struct {
 	// offbox (Part B): the restic-SFTP exec seam (nil → real restic) + the failure→operator-alert hook.
 	offboxRunner offboxRunner
 	offboxNotify func(dur time.Duration, snapshots int, err error)
+	// offboxPushObserver (the upload watch) measures the push; nil = none.
+	offboxPushObserver func() func()
 	// offboxStreamRunner + offboxProgress: the MANUAL run's live progress (v0.147.0, 4c). The stream
 	// seam scans restic's `--json` stdout line-by-line; the state is what the page polls. Both are
 	// inert on the nightly path — the sink is installed only for the duration of a manual run.