docs: explain Public hash exemption ordering

docs/cli_commands.md

@@ -2158,6 +2158,23 @@ set flood.rule.3 type=any channel=#hamradio retry
 set flood.rule.4 type=any channel=hash:A7 retry
 ```
 
+Because Public's visible hash is `0x11`, a bare `hash:11 drop` row also matches
+Public. To exempt authenticated Public while dropping other packets that carry
+the same visible byte, put the exact Public rule first and stop lower-priority
+rules after it:
+
+```text
+# Retry and preserve authenticated Public; drop other channel-hash 11 packets.
+set flood.rule.2 type=any channel=public retry stop priority=200
+set flood.rule.3 type=any channel=hash:11 drop priority=100
+```
+
+The Public row matches only after its MAC/decrypt check succeeds. A colliding
+channel therefore misses that `stop` and reaches the raw-hash drop row. Without
+the higher-priority `stop`, both rows match Public and the sticky `drop` action
+wins. Omit `retry` from the Public row when only the forwarding exemption is
+wanted.
+
 Deleting or replacing the last active `retry` row restores the legacy global
 retry eligibility. Firmware that predates the `retry`/`hash:XX` FPF7 extension
 cannot preserve tables containing those rows; remove them before downgrading.

docs/flood_filtering.md

@@ -441,6 +441,22 @@ get flood.rule.3
 get flood.rule.4
 ```
 
+Public's visible channel hash is `0x11`, so a `hash:11 drop` row also matches
+Public unless an earlier exact-channel rule stops it. This standalone example
+preserves authenticated Public while dropping other packets that use the same
+visible byte:
+
+```text
+set flood.rule.2 type=any channel=public retry stop priority=200
+set flood.rule.3 type=any channel=hash:11 drop priority=100
+```
+
+The Public rule's MAC/decrypt check must succeed before its `stop` applies. A
+colliding channel misses that rule and reaches the lower-priority hash drop.
+Without `stop`, both rows match Public and the sticky drop wins. Remove `retry`
+from the Public row if the exemption should not also opt Public into flood
+retry.
+
 The 240 KB STM32WL profiles keep `MESH_ENABLE_FLOOD_RULE_ENGINE=0` and retain
 the persistent compact FPF6 `flood.filter` and blacklist syntax below. They
 still perform filtering, but omit the generalized `flood.rule` parser and