deploy: c1028ee6c4

cli_commands/index.html

@@ -6940,6 +6940,19 @@ set flood.rule.3 type=any channel=#hamradio retry
 # This is an unauthenticated 1-byte hint, not a channel identity.
 set flood.rule.4 type=any channel=hash:A7 retry
 </code></pre>
+<p>Because Public's visible hash is <code>0x11</code>, a bare <code>hash:11 drop</code> row also matches
+Public. To exempt authenticated Public while dropping other packets that carry
+the same visible byte, put the exact Public rule first and stop lower-priority
+rules after it:</p>
+<pre><code class="language-text"># Retry and preserve authenticated Public; drop other channel-hash 11 packets.
+set flood.rule.2 type=any channel=public retry stop priority=200
+set flood.rule.3 type=any channel=hash:11 drop priority=100
+</code></pre>
+<p>The Public row matches only after its MAC/decrypt check succeeds. A colliding
+channel therefore misses that <code>stop</code> and reaches the raw-hash drop row. Without
+the higher-priority <code>stop</code>, both rows match Public and the sticky <code>drop</code> action
+wins. Omit <code>retry</code> from the Public row when only the forwarding exemption is
+wanted.</p>
 <p>Deleting or replacing the last active <code>retry</code> row restores the legacy global
 retry eligibility. Firmware that predates the <code>retry</code>/<code>hash:XX</code> FPF7 extension
 cannot preserve tables containing those rows; remove them before downgrading.</p>

flood_filtering/index.html

@@ -1990,6 +1990,18 @@ get flood.rule.2
 get flood.rule.3
 get flood.rule.4
 </code></pre>
+<p>Public's visible channel hash is <code>0x11</code>, so a <code>hash:11 drop</code> row also matches
+Public unless an earlier exact-channel rule stops it. This standalone example
+preserves authenticated Public while dropping other packets that use the same
+visible byte:</p>
+<pre><code class="language-text">set flood.rule.2 type=any channel=public retry stop priority=200
+set flood.rule.3 type=any channel=hash:11 drop priority=100
+</code></pre>
+<p>The Public rule's MAC/decrypt check must succeed before its <code>stop</code> applies. A
+colliding channel misses that rule and reaches the lower-priority hash drop.
+Without <code>stop</code>, both rows match Public and the sticky drop wins. Remove <code>retry</code>
+from the Public row if the exemption should not also opt Public into flood
+retry.</p>
 <p>The 240 KB STM32WL profiles keep <code>MESH_ENABLE_FLOOD_RULE_ENGINE=0</code> and retain
 the persistent compact FPF6 <code>flood.filter</code> and blacklist syntax below. They
 still perform filtering, but omit the generalized <code>flood.rule</code> parser and