Bring the wiki up to date through 1.6.0: DDoS capture file, paging, Merge and update.sh, Isolation Forest tuning mismatch
Document the new Auto Label dashboard page
Since 1.3.0's confidence gated labeling, review and Merge/Discard now
work from the console: a timestamped alert list, a sidebar badge, and
a review table, not just the terminal. Added to Dashboard.md's page
walkthrough and Configuration.md's Automatic Labeling section.
Update for 1.2.0: the Anomalous state, evasion-resistant features, the privilege-separated install layout, and the rate baseline freeze fix
Home.md and Dashboard.md: a second model, an Isolation Forest, now runs
alongside the classifier and surfaces a new Anomalous state; randomized
source spoofing detection is now partially addressed by three new
features invariant under address forgery, corrected from the previous
claim that this needed features the pipeline did not extract.
Configuration.md: documents --max-baseline-freeze-windows, points
training at scripts/train.sh, and adds a note on generator timing
regularity.
Troubleshooting.md: corrects 'Everything Is Flagged and It Never Stops'
this now resolves on its own after the configured freeze cap, not only
by wiping the baseline by hand.
Installation.md: corrects the install, admin-account-creation, and
update instructions for the privilege-separated layout (Stage 2's code
and venv in /opt/flod/stage2, state in /var/lib/flod, neither in the
checkout), which the previous wording did not reflect and which would
have created an admin account in a database the running service never
reads.
docs: enhance troubleshooting and dashboard guides with detailed explanations on attack sources and host flagging