docs(10-02): complete classification-layer test coverage plan

- 28 new subtests in TestClassify covering all new protocol/port combinations
- TestAllClassesCount updated to assert 32 classes
- All PROTO-01 through PROTO-09 requirements satisfied

.planning/REQUIREMENTS.md

@@ -21,7 +21,7 @@ Requirements for extended protocol coverage milestone. Each maps to roadmap phas
 - [x] **PROTO-06**: Add VoIP family: SIP (5060/5061)
 - [x] **PROTO-07**: Add Web family extension: QUIC/HTTP3 (UDP 443)
 - [x] **PROTO-08**: Add Infrastructure family protocols: LDAP (389/636), Kerberos (88), Syslog (514)
-- [ ] **PROTO-09**: Existing 10 protocol classifications remain unchanged — no regression in rule matching behavior
+- [x] **PROTO-09**: Existing 10 protocol classifications remain unchanged — no regression in rule matching behavior
 
 ### Frequency Design
 
@@ -82,7 +82,7 @@ Which phases cover which requirements. Updated during roadmap creation.
 | PROTO-06 | Phase 10 | Complete |
 | PROTO-07 | Phase 10 | Complete |
 | PROTO-08 | Phase 10 | Complete |
-| PROTO-09 | Phase 10 | Pending |
+| PROTO-09 | Phase 10 | Complete |
 | GRP-02 | Phase 11 | Pending |
 | GRP-03 | Phase 11 | Pending |
 

.planning/ROADMAP.md

@@ -37,7 +37,7 @@ Full details: `.planning/milestones/v1.1-ROADMAP.md`
 
 - [x] **Phase 8: Test and Constant Cleanup** - 1 plan — Remove stale constants and update test bounds that would block all subsequent v1.2 work (completed 2026-03-27)
 - [ ] **Phase 9: Frequency Design and Group Architecture** - 2 plans — Design complete Hz allocation for all ~35 classes in family bands and add Group field to FreqConfig
-- [ ] **Phase 10: Classification Layer** - 2 plans — Add 21 new TrafficClass constants, 30 port rules, and test coverage for all new protocol families
+- [x] **Phase 10: Classification Layer** - 2 plans — Add 21 new TrafficClass constants, 30 port rules, and test coverage for all new protocol families (completed 2026-03-27)
 - [ ] **Phase 11: Synthesis and Config Layer** - Add ClassFreqConfigs entries for all new classes, update auto-assign range, and add group-header output to --print-config
 
 ## Phase Details
@@ -77,10 +77,10 @@ Plans:
   2. All existing 10 protocol classifications continue to match as before — no regression in rule order or port assignments
   3. Multiple ports mapping to the same family class (e.g., IMAP port 143 and IMAPS port 993 both classify as the same Mail-IMAP class) behave identically in the classifier output
   4. `go test ./classify/...` passes with no new test failures
-**Plans:** 1/2 plans executed
+**Plans:** 2/2 plans complete
 Plans:
 - [x] 10-01-PLAN.md — Add 21 TrafficClass constants and 30 port-matching rules
-- [ ] 10-02-PLAN.md — Add 28 classification subtests and update TestAllClassesCount
+- [x] 10-02-PLAN.md — Add 28 classification subtests and update TestAllClassesCount
 
 ### Phase 11: Synthesis and Config Layer
 **Goal**: Every new traffic class produces a distinct, family-coherent sound and --print-config shows all classes organized by group with section headers
@@ -106,5 +106,5 @@ Plans:
 | 7. Custom Rules and Print-Config | v1.1 | 2/2 | Complete | 2026-03-26 |
 | 8. Test and Constant Cleanup | v1.2 | 1/1 | Complete   | 2026-03-27 |
 | 9. Frequency Design and Group Architecture | v1.2 | 1/2 | In Progress|  |
-| 10. Classification Layer | v1.2 | 1/2 | In Progress|  |
+| 10. Classification Layer | v1.2 | 2/2 | Complete   | 2026-03-27 |
 | 11. Synthesis and Config Layer | v1.2 | 0/? | Not started | - |

.planning/STATE.md

@@ -3,14 +3,14 @@ gsd_state_version: 1.0
 milestone: v1.2
 milestone_name: Extended Protocol Coverage
 status: executing
-stopped_at: Phase 10 context gathered
+stopped_at: Completed 10-02-PLAN.md
-last_updated: "2026-03-27T14:50:03.419Z"
+last_updated: "2026-03-27T14:59:24.215Z"
-last_activity: 2026-03-27 -- Phase 10 execution started
+last_activity: 2026-03-27
 progress:
   total_phases: 4
-  completed_phases: 2
+  completed_phases: 3
   total_plans: 5
-  completed_plans: 3
+  completed_plans: 5
   percent: 0
 ---
 
@@ -26,9 +26,9 @@ See: .planning/PROJECT.md (updated 2026-03-27)
 ## Current Position
 
 Phase: 10 (classification-layer) — EXECUTING
-Plan: 1 of 2
+Plan: 2 of 2
-Status: Executing Phase 10
+Status: Ready to execute
-Last activity: 2026-03-27 -- Phase 10 execution started
+Last activity: 2026-03-27
 
 Progress: [░░░░░░░░░░] 0%
 
@@ -51,6 +51,7 @@ Progress: [░░░░░░░░░░] 0%
 **Recent Trend:** Stable
 | Phase 08 P01 | 1 | 2 tasks | 2 files |
 | Phase 09 P02 | 3 | 2 tasks | 2 files |
+| Phase 10 P02 | 2 | 2 tasks | 1 files |
 
 ## Accumulated Context
 
@@ -65,6 +66,7 @@ Progress: [░░░░░░░░░░] 0%
 - [Phase 08]: NumLayers and GainPerLayer deleted — dead code since NewBank computes gain dynamically as 1/N
 - [Phase 08]: TestFrequenciesInRange now validates against Nyquist (22050 Hz) — any new BaseHz in (0, 22050) is accepted without test surgery
 - [Phase 09]: autoAssignFreq range moved to [2500, 4000] Hz with numSteps=31 to guarantee no collision with built-in frequencies (max 2449 Hz)
+- [Phase 10]: TestAllClassesCount updated to 32 (14 existing + 18 new; LDAP/Kerberos/Syslog excluded until Phase 11 adds ClassFreqConfigs)
 
 ### Pending Todos
 
@@ -77,6 +79,6 @@ Progress: [░░░░░░░░░░] 0%
 
 ## Session Continuity
 
-Last session: 2026-03-27T14:36:12.222Z
+Last session: 2026-03-27T14:59:24.206Z
-Stopped at: Phase 10 context gathered
+Stopped at: Completed 10-02-PLAN.md
-Resume file: .planning/phases/10-classification-layer/10-CONTEXT.md
+Resume file: None

.planning/phases/10-classification-layer/10-02-SUMMARY.md

@@ -0,0 +1,86 @@
+---
+phase: 10-classification-layer
+plan: 02
+subsystem: classify
+tags: [classification, tests, protocols, v1.2]
+dependency_graph:
+  requires: [10-01-classification-constants-and-rules]
+  provides: [28-new-classification-subtests, updated-TestAllClassesCount]
+  affects: [classify/classifier_test.go]
+tech_stack:
+  added: []
+  patterns: [table-driven subtests, buildTCPPacket/buildUDPPacket helpers]
+key_files:
+  created: []
+  modified:
+    - classify/classifier_test.go
+decisions:
+  - TestAllClassesCount updated to 32 (14 existing + 18 new; LDAP/Kerberos/Syslog excluded until Phase 11)
+  - 28 subtests added (plan said 26, final count is 28 including extra SIP transport variants)
+metrics:
+  duration: "2 min"
+  completed: "2026-03-27"
+  tasks_completed: 2
+  files_modified: 1
+requirements_satisfied:
+  - PROTO-01
+  - PROTO-02
+  - PROTO-03
+  - PROTO-04
+  - PROTO-05
+  - PROTO-06
+  - PROTO-07
+  - PROTO-08
+  - PROTO-09
+---
+
+# Phase 10 Plan 2: Classification Layer — Test Coverage Summary
+
+Added 28 new subtests to `TestClassify` covering all new port/protocol/transport combinations introduced in Plan 01, and updated `TestAllClassesCount` to assert 32 classes.
+
+## Tasks Completed
+
+| Task | Name | Commit | Files |
+|------|------|--------|-------|
+| 1 | Add 28 new classification subtests to TestClassify | 038f89f | classify/classifier_test.go |
+| 2 | Update TestAllClassesCount from 14 to 32 | f792370 | classify/classifier_test.go |
+
+## What Was Done
+
+**Task 1** added 28 new subtests inside `TestClassify`, grouped by protocol family, after the existing `TestClassifyUnknown` subtest and before `TestRulesAreOrderDependent`:
+
+- Mail (PROTO-01): IMAP 143, IMAPS 993, POP3 110, POP3S 995, SMTPSub 587
+- File Transfer (PROTO-02): FTP data 20, FTP control 21, SMB 445, TFTP UDP/69
+- Remote Access (PROTO-03): RDP 3389, Telnet 23, VNC 5900
+- Database (PROTO-04): MySQL 3306, PostgreSQL 5432, Redis 6379, MongoDB 27017
+- Discovery (PROTO-05): mDNS UDP/5353, SSDP UDP/1900, SNMP UDP/161, SNMP-trap UDP/162
+- VoIP (PROTO-06): SIP TCP/5060, SIP UDP/5060
+- Web extension (PROTO-07): QUIC UDP/443 (confirmed distinct from HTTPS TCP/443)
+- Infrastructure (PROTO-08): LDAP 389, LDAPS 636, Kerberos TCP/88, Kerberos UDP/88, Syslog UDP/514
+
+All existing 13 subtests (ICMP, DNS UDP/TCP, HTTPS, HTTP, SSH, SMTP, NTP, DHCP 67/68, OtherTCP, OtherUDP, Unknown) remain passing unchanged (PROTO-09 regression check).
+
+**Task 2** updated `TestAllClassesCount` assertion from `!= 14` to `!= 32`. The 32 count is 14 existing + 18 new (ClassLDAP, ClassKerberos, ClassSyslog excluded from AllClasses() until Phase 11 adds their ClassFreqConfigs entries).
+
+## Verification Results
+
+- `go test -count=1 ./classify/... -v` — all 3 test functions pass (TestClassify with 41 subtests, TestAllClassesCount, TestHashBucketDistribution)
+- All 28 new subtests pass on first run (no iteration needed)
+- QUIC UDP/443 correctly classifies as ClassQUIC, not ClassHTTPS
+- SIP tested on both TCP and UDP transports
+- `go test ./synth/...` expected to fail (Phase 11 will wire ClassFreqConfigs for 18 new classes)
+
+## Deviations from Plan
+
+None — plan executed exactly as written. Note: plan mentioned 26 new subtests but the task description listed 28 (the SSDP test name was `TestClassifySDP_port1900` per the plan, and the SIP dual-transport tests account for the discrepancy). All 28 listed in the acceptance criteria were implemented.
+
+## Known Stubs
+
+None.
+
+## Self-Check: PASSED
+
+- classify/classifier_test.go exists and contains `TestClassifyIMAP_port143`
+- classify/classifier_test.go contains `!= 32`
+- Commits 038f89f and f792370 exist
+- `go test -count=1 ./classify/...` exits 0