hub 0.169.0 (unreleased, not built): the upload watch's four events — allowed, operator-only, per-app cooldown, one readable Watch line in the operator mail

app_unexplained_upload / app_unexplained_cpu (warning) and their _cleared (info), from controller v0.342.0 (08 section 9,
operator ruling 2026-10-23). Red-proved: operator-only, the render line, the allow-list.

hub/internal/api/handler.go

@@ -2410,6 +2410,13 @@ var allowedEventTypes = map[string]bool{
 	// definition (a correction, an update, a restore, a settings change) — nothing was written, the app runs on its last
 	// good compose. Operator-only (notify.operatorOnlyEvents) — registered in BOTH in the same commit.
 	"app_definition_refused": true,
+	// The upload and CPU watch (hub v0.169.0, controller v0.342.0; `08` §9, operator ruling 2026-10-23): an app sent or burnt
+	// far more than its own numbers explain — the sign of a hacked app (Plex2Shell) — and the clear when it stopped.
+	// Operator-only (notify.operatorOnlyEvents) — registered in BOTH in the same commit.
+	"app_unexplained_upload":         true,
+	"app_unexplained_upload_cleared": true,
+	"app_unexplained_cpu":            true,
+	"app_unexplained_cpu_cleared":    true,
 	// Special
 	"test": true,
 }