hub 0.169.0 (unreleased, not built): the upload watch's four events — allowed, operator-only, per-app cooldown, one readable Watch line in the operator mail

app_unexplained_upload / app_unexplained_cpu (warning) and their _cleared (info), from controller v0.342.0 (08 section 9,
operator ruling 2026-10-23). Red-proved: operator-only, the render line, the allow-list.

hub/internal/api/handler.go

@@ -2410,6 +2410,13 @@ var allowedEventTypes = map[string]bool{
 	// definition (a correction, an update, a restore, a settings change) — nothing was written, the app runs on its last
 	// good compose. Operator-only (notify.operatorOnlyEvents) — registered in BOTH in the same commit.
 	"app_definition_refused": true,
+	// The upload and CPU watch (hub v0.169.0, controller v0.342.0; `08` §9, operator ruling 2026-10-23): an app sent or burnt
+	// far more than its own numbers explain — the sign of a hacked app (Plex2Shell) — and the clear when it stopped.
+	// Operator-only (notify.operatorOnlyEvents) — registered in BOTH in the same commit.
+	"app_unexplained_upload":         true,
+	"app_unexplained_upload_cleared": true,
+	"app_unexplained_cpu":            true,
+	"app_unexplained_cpu_cleared":    true,
 	// Special
 	"test": true,
 }

hub/internal/api/upwatch_event_test.go

@@ -0,0 +1,20 @@
+package api
+
+import (
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-hub/internal/notify"
+)
+
+// The four upload-watch types are accepted from a box (an unlisted type is a 400 and is dropped) AND operator-only —
+// both registers, same commit. RED-PROOF: drop one from allowedEventTypes → fails.
+func TestUpwatchEventTypesAreAllowedAndOperatorOnly(t *testing.T) {
+	for _, et := range []string{"app_unexplained_upload", "app_unexplained_upload_cleared", "app_unexplained_cpu", "app_unexplained_cpu_cleared"} {
+		if !allowedEventTypes[et] {
+			t.Errorf("%s is not in allowedEventTypes — POST /event would 400 and the alarm would be lost", et)
+		}
+		if !notify.IsOperatorOnly(et) {
+			t.Errorf("%s is not operator-only", et)
+		}
+	}
+}