README: rtl-sdr.com feature link + blog-reader pointer to APOCALYPSE-EDITION; add 'Open problems' section (antenna range, mid/DPU ID, HOT command+BCH, direction-of-travel, taxonomy portability) — invite contributions

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -6,7 +6,9 @@ trackside **defect detectors** on 160–162 MHz, and the **End-of-Train** and **
 telemetry on 457.9375 / 452.9375 MHz. It decodes the End-of-Train brake-pressure and motion data,
 transcribes the voice, and fuses it all into one live verdict.
 
-**Live instance:** [istrain.jhestyr.net](https://istrain.jhestyr.net)
+**Live instance:** [istrain.jhestyr.net](https://istrain.jhestyr.net) · [featured on rtl-sdr.com](https://www.rtl-sdr.com/istrain-detecting-if-a-train-is-blocking-a-local-crossing-by-listening-to-railroad-frequencies/)
+
+**New here from the blog?** → the full build guide is [`APOCALYPSE-EDITION.md`](APOCALYPSE-EDITION.md) (human- or coding-agent-readable). Open problems we'd take help on are at the bottom.
 
 It's built on a couple of ~US$30 RTL-SDR dongles, some wire, and an always-on Linux box running
 Docker. No transmitting, no license needed to receive in the US, no railroad cooperation — the
@@ -54,6 +56,26 @@ straight through by a human **or** handed to an LLM coding agent pointed at this
 Any one can be too weak to read, but a real train lights several bands at once — so istrain
 correlates across all of them.
 
+## Open problems — what we're still figuring out
+
+Passersby with RF chops: these are the live unknowns. Pull requests, corrections, and "actually,
+it works like this" all welcome.
+
+- **Range is antenna-bound.** The rail voice band is weak and buried in house RF; gain doesn't help
+  (it just amplifies the noise). A grounded rooftop antenna is the open lever — height and distance
+  from the shack, not dBi. What we've got works; what we want is the dwellers' faint keys cleanly.
+- **Mid-train / DPU bursts (±12.5 kHz off the EOT/HOT centers) are unidentified.** They're *not*
+  drifted EOT (our decoder says no). Next step is sub-channel labeling to separate a real
+  distributed-power emitter from the fixed wayside booster carrier before any raw-IQ demod.
+- **The Head-of-Train frame is only half-cracked.** We recover the frame and decode the *addressed
+  unit* (enough to join head to tail), but the command/type field + BCH are still unread. HOT-format
+  docs are scarce; if you know the framing, we'd love a pointer.
+- **Direction of travel** should fall out of the approach/recede signal envelope — unbuilt, and
+  blocked on the better antenna above.
+- **The brake-pressure taxonomy** (passing / dwelling / cut-and-standing / departing) came from ~50
+  ground-truthed passages on one subdivision. It may read differently on other railroads and
+  operating patterns — more ground truth from other crossings would sharpen it.
+
 ## License & credits
 
 **GPLv3** — see [`LICENSE`](LICENSE). The EOT decoder validates frames against