hub 0.169.0 (unreleased, not built): the upload watch's four events — allowed, operator-only, per-app cooldown, one readable Watch line in the operator mail

app_unexplained_upload / app_unexplained_cpu (warning) and their _cleared (info), from controller v0.342.0 (08 section 9,
operator ruling 2026-10-23). Red-proved: operator-only, the render line, the allow-list.

hub/internal/api/upwatch_event_test.go

@@ -0,0 +1,20 @@
+package api
+
+import (
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-hub/internal/notify"
+)
+
+// The four upload-watch types are accepted from a box (an unlisted type is a 400 and is dropped) AND operator-only —
+// both registers, same commit. RED-PROOF: drop one from allowedEventTypes → fails.
+func TestUpwatchEventTypesAreAllowedAndOperatorOnly(t *testing.T) {
+	for _, et := range []string{"app_unexplained_upload", "app_unexplained_upload_cleared", "app_unexplained_cpu", "app_unexplained_cpu_cleared"} {
+		if !allowedEventTypes[et] {
+			t.Errorf("%s is not in allowedEventTypes — POST /event would 400 and the alarm would be lost", et)
+		}
+		if !notify.IsOperatorOnly(et) {
+			t.Errorf("%s is not operator-only", et)
+		}
+	}
+}