DooPlex backup alarms: one cause (the dump job's password after the reboot), fixed; alarm mail quieter; R-1250 proven

R-232 dated note + a dated check for tonight's sweep; R-934 closed (the disk was pulled
2026-10-23); R-1250 fixed on main, live proof on demo-hp with a real seed; 08 §9 item 5.
Evidence audits/dooplex-alarms-2026-10-24/.

documentation/architecture/08-alarm-ladder.md

@@ -564,9 +564,17 @@ normal use; work it does not explain is the sign of a hacked app. Numbers and me
    household is told only about the qBittorrent limit, because they can change it (R-1246 asks the operator).
 5. **qBittorrent's default upload limit:** 50 % of the TESTED line (D41 = 50 %, operator 2026-10-24; never of the
    push floor), every 15 minutes, re-set when the line moves > 20 %; never over a limit the household set (one there
-   first, or any change from the value qBittorrent stored for the box — it keeps KiB/s). No test → none set. **Known
-   gap (R-1250):** a qBittorrent that seeds all day keeps the uplink from ever being quiet for 10 minutes, so that box is
-   never tested and gets no limit — the case the limit exists for. While the box owns it, qBittorrent's page says: „A qBittorrent
+   first, or any change from the value qBittorrent stored for the box — it keeps KiB/s). No test → none set. **A box
+   that seeds all day (R-1250, brief 2026-10-24; committed agent `29bcf44`+`1e087bb`, controller `046b808`, not yet
+   released):** the 10 quiet minutes never come, so when the agent reports `waiting_for_quiet` (due, in the window,
+   tunnel up, the full 10-minute window watched and busy) and qBittorrent or Transmission runs, the controller writes
+   `upwatch.line_test_hold` (the app's limit exactly as stored) FIRST, holds the app at 1 KiB/s (Transmission 1 kB/s),
+   calls `POST /host/line-test/run` (5 s settle, 10 s quiet check < 2 Mbit/s, three runs 5 s apart — about 55 s), then
+   puts the old limit back, the household's own included; a change made during the test stays; a killed controller's
+   start-up check puts it back; the 50 % rule waits while a record exists. Measured on demo-hp with a real seed (10
+   Mbit/s to DooPlex's qBittorrent): refused `not-quiet` without the hold; with it the uplink fell to 0.02–0.16 Mbit/s,
+   94.2 Mbit/s measured, the app held 56.8 s and back to 1 249 280 B/s exactly (`audits/dooplex-alarms-2026-10-24/`).
+   While the box owns it, qBittorrent's page says: „A qBittorrent
    feltöltése legfeljebb N Mbit/s, hogy a családi internet gyors maradjon. A qBittorrentben átállíthatod."
 6. **Limits, stated:** an attacker who knows the check can make the app's API lie — a per-container ceiling (`tc` from
    a helper in the app's network namespace, measured to work in an unprivileged guest; spike §5) would cap the flood