{{-- Simple-language SMART / EWMA guide for administrators --}}
<div class="modal fade fwp-modal" id="fwp-ewma-guide-modal" tabindex="-1" role="dialog">
    <div class="modal-dialog modal-lg" role="document">
        <div class="modal-content">
            <div class="modal-header">
                <button type="button" class="close" data-dismiss="modal"><span>&times;</span></button>
                <h4 class="modal-title">SMART and EWMA: plain-English guide</h4>
            </div>
            <div class="modal-body" style="max-height:70vh;overflow-y:auto;">
                <p><strong>What SMART does (big picture).</strong> SMART watches how much traffic <em>normally</em> hits your game port. When traffic suddenly jumps far above that “normal line”, the node can automatically add temporary protection (mitigation). Think smoke alarm plus sprinkler: it reacts when something looks wrong.</p>

                <p><strong>What EWMA means (without the math).</strong> EWMA is a smoothed recent average. Instead of reacting to one tiny spike, the node blends the last few seconds together so a single stray packet does not trigger chaos. It is like a teacher averaging quiz scores instead of grading on one pop question.</p>

                <p><strong>Alpha (EWMA alpha, 0–1).</strong> How quickly the “normal line” follows new traffic.</p>
                <ul>
                    <li><strong>Higher alpha (closer to 1):</strong> reacts faster; good for very bursty games, but more sensitive.</li>
                    <li><strong>Lower alpha (closer to 0.1):</strong> smoother baseline; slower to react, fewer false alarms.</li>
                </ul>
                <p><em>Example:</em> Default <code>0.3</code> is a balanced starting point for many Minecraft / Source-style servers.</p>

                <p><strong>Anomaly multiplier.</strong> “How many times louder than normal before we call it an attack?” If baseline is ~20 connections/sec and multiplier is <code>3</code>, traffic near <code>60/s</code> starts looking suspicious.</p>
                <p><em>Example:</em> A server that normally peaks at 40/s might use multiplier <code>2.5</code> so mitigation starts around 100/s.</p>

                <p><strong>Warmup samples.</strong> How many readings to collect before EWMA is trusted. Too low = jumpy; too high = slow to arm.</p>
                <p><em>Example:</em> Default <code>10</code> means “ignore the first few seconds of weirdness while we learn.”</p>

                <p><strong>Level 1 rate limit (SMART).</strong> First-line automatic throttle when things look odd. Usually gentler than full mitigation.</p>
                <p><em>Example:</em> <code>50/second</code> caps how aggressively SMART throttles before escalation.</p>

                <p><strong>Cooldowns L1 / L2 / L3.</strong> How long SMART waits before lowering protection after traffic calms down. L3 is the longest “timeout corner” after repeated issues.</p>
                <p><em>Example:</em> Defaults <code>30s / 120s / 300s</code>: short first relief, longer if attacks keep returning.</p>

                <p><strong>When <em>not</em> to touch these.</strong> If players report random lag after you tweak EWMA, revert to defaults first. These settings interact with each other; change one thing at a time.</p>

                <p class="text-muted"><strong>Defaults recap:</strong> alpha <code>0.3</code>, multiplier <code>3.0</code>, warmup <code>10</code>, L1 limit <code>50/second</code>, cooldowns <code>30 / 120 / 300</code> seconds.</p>
            </div>
            <div class="modal-footer">
                <button type="button" class="btn btn-default" data-dismiss="modal">Close</button>
            </div>
        </div>
    </div>
</div>