Support 2+ path-hash width filters

docs/filter_tool.md

@@ -33,6 +33,11 @@ and local delivery remain unaffected. Width-only rules require updated
 firmware. The simulator's policy definitions remain design-preview text, not
 installable commands.
 
+Select **2+ bytes (2 or 3)** to match both larger widths in one rule. The
+firmware command is `set fr any pb=2+ d`. A rate-limit action on this rule uses
+one allowance shared by both widths, rather than a separate limit for each.
+Four-byte paths remain unsupported.
+
 <div class="filter-tool" data-filter-tool>
   <div class="filter-management-safety" role="note">
     <strong>Remote login and direct routes</strong>
@@ -77,7 +82,7 @@ installable commands.
             <tr><td><code>channel=</code></td><td><code>*</code> means no channel condition; a name or key authenticates one group channel; <code>hash:XX</code> is an unauthenticated one-byte fallback</td></tr>
             <tr><td><code>rx.scope=</code></td><td>Original incoming transport scope</td></tr>
             <tr><td><code>path=</code></td><td>Path prefix, blacklist, bucket, or loop match</td></tr>
-            <tr><td><code>hashbytes=</code></td><td>Encoded path-hash width: 1, 2, or 3 bytes, including zero-hop packets</td></tr>
+            <tr><td><code>hashbytes=</code></td><td>Encoded path-hash width: 1, 2, 3, or 2+ (2 and 3 bytes), including zero-hop packets</td></tr>
             <tr><td><code>tempradio=</code></td><td>Temporary-radio state</td></tr>
             <tr><td><code>do drop</code></td><td>Do not retransmit</td></tr>
             <tr><td><code>do scope=</code></td><td>Set the outgoing transport scope</td></tr>
@@ -96,6 +101,10 @@ installable commands.
         <span>Drop all floods with 1-byte path hashes (including zero hops)</span>
         <code>when type=any hops=all hashbytes=1 do drop</code>
       </button>
+      <button type="button" data-example="hash_width_two_plus">
+        <span>Drop all floods with 2- or 3-byte path hashes (including zero hops)</span>
+        <code>when type=any hops=all hashbytes=2+ do drop</code>
+      </button>
       <button type="button" data-example="channel_scope">
         <span>Set #BlackHole86 scope on all #rgdata group traffic</span>
         <code>when type=class:group hops=all channel=#rgdata do scope=#BlackHole86 timing=fast</code>
@@ -205,6 +214,7 @@ installable commands.
             <option value="0">Any width</option>
             <option value="1">1 byte</option>
             <option value="2">2 bytes</option>
+            <option value="2+">2+ bytes (2 or 3)</option>
             <option value="3">3 bytes</option>
           </select>
         </label>