Wire axon/vr_headset alerts + document new categories

- Morse alerts: axon -> A (threat tone), vr_headset -> E (single dit; benign,
  not treated as a surveillance threat)
- README: 10 categories (add axon, vr_headset), correct the now-stale
  false-positive caveat (Silicon Labs + Raspberry Pi OUIs were removed from the
  Flock list; real Flock-on-RPi relies on name/mfr-id, not bare OUI)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -43,32 +43,37 @@ Dantir uses **seven detection methods** across BLE and WiFi:
 
 | Method | Radio | How it matches |
 |--------|-------|----------------|
-| `mac_prefix` | BLE | MAC OUI against ~20 Flock Safety prefixes |
+| `mac_prefix` | BLE | MAC OUI against the Flock Safety prefix set (lowest confidence — see note) |
 | `device_name` | BLE | Advertised name patterns (Flock, Penguin, Pigvision, Ring, Ray-Ban…) |
 | `ble_mfr_id` | BLE | Bluetooth manufacturer company IDs |
 | `raven_uuid` | BLE | Raven gunshot-detector service UUIDs (+ firmware-version estimate) |
 | `wifi_probe` | WiFi | Probe-request source MAC OUI (promiscuous mode) |
 | `wifi_beacon` | WiFi | Beacon-frame source MAC OUI (promiscuous mode) |
 
-Detections are grouped into **eight categories**, each with its own Morse-code
+Detections are grouped into **ten categories**, each with its own Morse-code
 audio signature on the buzzer:
 
 | Category | Morse | What it covers |
 |----------|:-----:|----------------|
-| `flock`   | ··-· (F) | Flock Safety / ALPR cameras, Penguin, Pigvision |
+| `flock`      | ··-· (F) | Flock Safety / ALPR cameras, Penguin, Pigvision |
-| `glasses` | --· (G)  | Recording smart glasses (Ray-Ban Meta, Oakley, Snap) |
+| `axon`       | ·- (A)   | Axon ALPR cameras (the vendor replacing Flock in some cities) |
-| `tracker` | - (T)    | Bluetooth trackers (Tile, etc.) |
+| `glasses`    | --· (G)  | Camera-equipped smart glasses (Ray-Ban Meta, Oakley, Snap) |
-| `lawenf`  | ·-·· (L) | Law-enforcement gear (TASER/Axon, Motorola Solutions) |
+| `vr_headset` | · (E)    | VR headsets (Quest/Oculus) — benign; logged with a quiet blip, not a threat alert |
-| `ring`    | ·-· (R)  | Ring / Blink / Amazon cameras |
+| `tracker`    | - (T)    | Bluetooth trackers (Tile, etc.) |
-| `camera`  | ··· (S)  | Other surveillance cameras (Hikvision, Arlo, Wyze) |
+| `lawenf`     | ·-·· (L) | Law-enforcement gear (TASER/Axon body-cams, Motorola Solutions) |
-| `raven`   | ···- (V) | Raven gunshot-detector nodes |
+| `ring`       | ·-· (R)  | Ring / Blink / Amazon cameras |
-| `wifi`    | ·-- (W)  | Generic WiFi-side detections |
+| `camera`     | ··· (S)  | Other surveillance cameras (Hikvision, Arlo, Wyze) |
+| `raven`      | ···- (V) | Raven gunshot-detector nodes |
+| `wifi`       | ·-- (W)  | Generic WiFi-side detections |
 
-> **Detection is signature-based, not proof.** OUI/manufacturer matches catch
+> **Detection is signature-based, not proof.** Many OUIs are shared across a
-> consumer hardware that shares the same chipset vendors (e.g. some Wyze, Hue,
+> chipset vendor's entire catalog, so a bare `mac_prefix` match is the
-> or OBD-II dongles can trip a low-confidence match). Treat `device_name` and
+> lowest-confidence signal. Treat `device_name`, `ble_mfr_id`, and `raven_uuid`
-> `ble_mfr_id` hits as higher confidence than a bare `mac_prefix` match, and
+> hits as higher confidence, and confirm visually before drawing conclusions.
-> confirm visually before drawing conclusions.
+> Known shared-OUI false-positive sources — e.g. a Silicon Labs prefix that also
+> covers Wyze locks and OBD-II dongles, and the Raspberry Pi prefix — have been
+> pulled from the Flock list; real Flock-on-RPi now relies on name (Penguin /
+> Pigvision) and manufacturer ID, not a bare OUI.
 
 ---
 

src/main.cpp

@@ -450,6 +450,12 @@ static void fyMorseCategory(const char* category) {
     } else if (strcmp(category, "raven") == 0) {
         // V: ···-
         fyMorseDit(); fyMorseDit(); fyMorseDit(); fyMorseDah();
+    } else if (strcmp(category, "axon") == 0) {
+        // A: ·-  (Axon ALPR — Flock's municipal replacement)
+        fyMorseDit(); fyMorseDah();
+    } else if (strcmp(category, "vr_headset") == 0) {
+        // E: ·  (single dit — VR headset, benign; quiet acknowledgement, not a threat)
+        fyMorseDit();
     } else {
         // Unknown: single long beep
         fyMorseDah(); fyMorseDah();