Attended release run done: controller 0.342.0 the global floor, agent 0.164.0 vouched, hub 0.169.0; R-1244 and R-1247 closed (register 193 -> 191); capability F13; STATUS; the run report

documentation/architecture/capability-map-detail/F.md

@@ -219,3 +219,25 @@ Tester 1 run controller 0.311.0. An Immich image bump the repair was not proven
 **Evidence:** `audits/immich-repair-2026-10-14/` — spike A on 9202 (the five candidates), the scripts on real damage
 (9202), the live cut on demo-hp 9201 (D/). **Not exercised live:** a lost original (the cut lost none); pinned by unit
 tests and the 9202 run.
+
+## F13 — A hacked app is noticed (the upload and CPU watch, the weekly line test)
+
+*Map row: [F13](../00-capability-map.md#f13) · added 2026-10-24.*
+
+**Scenario:** an app on a household box sends far more than it says it sends, or burns CPU with no transcode to explain
+it (the Plex2Shell shape). Once a minute the controller reads every app's exact counters and asks the app (qBittorrent,
+Transmission, Plex); not explained for 15 / 30 minutes → one operator-only alarm, one clear when it stops. Once a week
+the host's agent measures the upload line with a 10-second iperf3 upload to ep0 inside the tunnel; qBittorrent's default
+upload limit is half of the tested line, never over the household's own limit.
+
+**Components:** controller v0.342.0 (`internal/upwatch`, `agentapi.LineTest`), agent v0.164.0 (`internal/linetest`),
+hub v0.169.0 (four operator-only events; the System page's „Upload line"), ep0 `felhom-iperf3.service`.
+
+**Status:** **PROVEN-LIVE** — the alarm path on scratch 9202 with `0.342.0-rc.1` (2026-10-23: a 50 Mbit/s flood hidden
+behind a real seed → one alarm after 15 min, one clear; a CPU burner in Plex → the same; a real seed → none); the line test
+on the three test boxes (2026-10-24: 94.3 / 94.4 / 92.6 Mbit/s; „server busy" retried); the qBittorrent limit on
+demo-felhom (5 789 696 B/s = 50 % of 92.6 Mbit/s, three channels agree).
+
+**Evidence:** `audits/SPIKE-upload-watch-2026-10-23.md` §7; `audits/line-test-2026-10-24/`. **Not exercised live:** an
+alarm reaching the operator's mailbox from a real box (the 9202 proof had no hub); the family's line on qBittorrent's
+page on demo-felhom (pinned by a render test). **Gaps:** R-1250, R-1248.