v0.342.0 (unreleased): the upload and CPU watch — an app that sends or burns far more than its own numbers explain is one operator-only alarm; the line learnt from the off-site push; qBittorrent's default upload limit (never over the household's)

internal/upwatch: exact per-container counters from the Docker Engine API, per-app judging (upload >= max(5 Mbit/s,
25% of the line) for 15 min; CPU >= max(150%, 50% x cores) for 30 min), explainers qBittorrent / Transmission / Plex,
app_unexplained_upload / app_unexplained_cpu + _cleared (hub 0.169.0). The off-site push is sampled once a second
for the line (a lower bound). qBittorrent limit = 50% of the line, the household's limit always wins. 20 red-proofs.
Spike + design: felhom.eu audits/SPIKE-upload-watch-2026-10-23.md, architecture/08 section 9. Not released.

controller/internal/i18n/locales/en.json

@@ -2782,6 +2782,16 @@
   "poweroff.refused.other_guests": "Another system runs on this machine, so it cannot be turned off from here.",
   "poweroff.refused.generic": "The machine cannot turn itself off safely right now. Try again in a few minutes.",
   "event.app_repaired_after_crash": "%s: after the unexpected stop, %d damaged preview file(s), %d repaired, %d still broken; lost originals: %d",
+  "event.app_unexplained_upload": "%s: uploaded %.1f Mbit/s for %d minutes, but the app itself counted only %.1f Mbit/s. This can be the sign of a hacked app.",
+  "event.app_unexplained_upload_noapp": "%s: uploaded %.1f Mbit/s for %d minutes; the app gives no number to compare, and this is far more than usual. This can be the sign of a hacked app.",
+  "event.app_unexplained_upload_cleared": "%s: the unexplained upload stopped.",
+  "event.app_unexplained_cpu": "%s: %.0f%% CPU (counted on one core) for %d minutes, with no work that explains it. This can be the sign of a hacked app.",
+  "event.app_unexplained_cpu_cleared": "%s: the unexplained CPU use stopped.",
+  "upwatch.qb_limit_note": "qBittorrent uploads at most %s Mbit/s, so the family internet stays fast. You can change this in qBittorrent.",
+  "upwatch.line_at_least": "at least",
+  "upwatch.line_measured": "Mbit/s (measured from the nightly off-site backup)",
+  "upwatch.line_label": "Upload speed",
+  "upwatch.line_learning": "still being measured (from the nightly off-site backup)",
   "event.app_repair_after_crash_skipped": "%s: the repair after the unexpected stop was skipped: %s",
   "app_info.lost_files_title": "Photos lost in an unexpected stop",
   "app_info.lost_files_text": "The machine stopped unexpectedly (for example in a power cut), and these files were lost. The machine started again at:",