# Scout add-on spec: broadband RF "bug sweep" mode

**Status:** proposal (firmware/hardware, not built here). **Inspired by:** RamboRogers/RFHunter (GPLv3).

## Why
Scout's SPY detector is *protocol-based*: it identifies cameras/ALPR/drones/trackers by their
Wi-Fi/BLE radio (OUI, SSID, BLE IDs). It is blind to devices that emit RF but no decodable
Wi-Fi/BLE: analog wireless cameras (1.2/2.4/5.8 GHz FPV/CCTV), some bugs, and transmitters
that are "on" but not associating. A broadband RF power detector catches those.

## How (RFHunter approach)
- **Sensor:** AD8317 (or AD8318) logarithmic RF power detector, ~1 MHz–8 GHz, analog Vout.
- **Read:** Vout -> an ESP32-S3 ADC pin (RFHunter uses GPIO34; pick a free ADC1 pin on the
  Waveshare, avoiding the SD/touch conflicts GPIO18/13/14). A boost converter (3.3->~5-9V)
  powers the AD8317.
- **Display:** reuse Scout's Hunter "RSSI geiger" UI — bar + rising tone as power increases;
  it already exists for Wi-Fi/BLE RSSI, so this is a second signal source.
- **Sweep:** the AD8317 is broadband (no tuning). For *band* discrimination you'd add a
  stepped filter or a real SDR; v1 is broadband "hot/cold" only, like RFHunter.

## Licence
RFHunter is **GPLv3**. If any RFHunter code is reused, that firmware component inherits GPLv3.
Keep it a separable module. Scout already carries GPL (Paradise native) and BSD (mp4box) parts,
so this is manageable but must be documented in third-party-licenses.txt.

## Honest limits
Broadband power says "there is RF here," not "a camera is here." It picks up phones, routers,
microwaves and your own radios. It is a *sweep aid*, strongest in a quiet room, used alongside
the protocol detector — not a standalone verdict. Passive only (receive/measure, never transmit).