chore: complete v1.1 milestone — Custom Sound Mappings

Archive roadmap and requirements to milestones/, update PROJECT.md
with shipped state, collapse ROADMAP.md, update retrospective.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

README.md

@@ -22,6 +22,9 @@ sudo netsynth -i eth0 --filter "port 53" -o dns.mp3
 
 # Use a custom sound config
 sudo netsynth -i eth0 --config my-sounds.toml
+
+# Print effective config as a starting template
+netsynth --print-config > my-sounds.toml
 ```
 
 ## Installation
@@ -71,6 +74,7 @@ netsynth [flags]
 | `-o`, `--output` | Output MP3 file path (default: `netsynth-<timestamp>.mp3`) |
 | `--filter` | BPF filter expression, tcpdump syntax (e.g. `"port 53"`) |
 | `--config` | Path to a TOML config file for custom sound mappings |
+| `--print-config` | Print the full effective config as commented TOML and exit |
 | `--verbose` | Print per-window protocol activity to stderr |
 | `--list-interfaces` | List available network interfaces and exit |
 
@@ -91,11 +95,14 @@ netsynth --read traffic.pcap --filter "udp" -o udp-only.mp3
 
 # Use a custom sound config
 sudo netsynth -i eth0 --config ~/my-sounds.toml
+
+# Print the full effective config (great for creating a template)
+netsynth --print-config > my-sounds.toml
 ```
 
 ## Custom Sound Configuration
 
-NetSynth supports TOML config files to override the default sound mappings per traffic class. You can change the frequency and waveform for any class without affecting the others.
+NetSynth supports TOML config files to override the default sound mappings per traffic class. You can change the frequency and waveform for any class, define your own classification rules, and inspect the effective config — all without affecting defaults you don't touch.
 
 ### Config File Discovery
 
@@ -139,6 +146,47 @@ waveform = "square"
 
 All waveforms use bandlimited additive synthesis to prevent aliasing artifacts.
 
+### Custom Classification Rules
+
+Define your own traffic classification rules using `[[rules]]` blocks. User-defined rules fire before built-in rules (first-match-wins):
+
+```toml
+# Match internal API traffic on port 8080
+[[rules]]
+protocol = "tcp"
+port = 8080
+class = "InternalAPI"
+
+# Match all UDP traffic (port omitted = match any)
+[[rules]]
+protocol = "udp"
+class = "AllUDP"
+
+# Optionally customize the sound for your custom class
+[sounds.InternalAPI]
+frequency = 1500.0
+waveform = "sawtooth"
+```
+
+Custom classes that don't have a `[sounds.*]` entry automatically get a unique frequency in the 1200-2350 Hz range.
+
+### Print Config
+
+Inspect the full effective configuration (defaults merged with your overrides):
+
+```bash
+# Print defaults (useful as a starting template)
+netsynth --print-config
+
+# Print with your overrides applied
+netsynth --config my-sounds.toml --print-config
+
+# Save as a template to edit
+netsynth --print-config > template.toml
+```
+
+The output includes `(default)`, `(override)`, and `(auto-assigned)` annotations so you can see what's customized.
+
 ### Validation
 
 - **Unknown keys** are rejected at startup with an error naming the bad key (catches typos like `frequncy`)
@@ -155,7 +203,7 @@ Capture -> Classify -> Aggregate -> Synthesize -> MP3
 
 1. **Capture** — Packets are read from a live interface (via [go-pcap](https://github.com/packetcap/go-pcap)) or a pcap file. Optional BPF filtering reduces the stream to traffic of interest.
 
-2. **Classify** — Each packet is matched against 12 protocol rules (ICMP, DNS, HTTPS, SSH, HTTP, SMTP, NTP, DHCP, etc.). Unrecognized traffic is deterministically hash-bucketed into 4 "unknown" classes so it still produces distinct sounds.
+2. **Classify** — Each packet is matched against protocol rules (ICMP, DNS, HTTPS, SSH, HTTP, SMTP, NTP, DHCP, etc.) plus any user-defined rules from the config file. User rules fire first. Unrecognized traffic is deterministically hash-bucketed into 4 "unknown" classes so it still produces distinct sounds.
 
 3. **Aggregate** — Classified packets are grouped into 500ms time windows. Each window records per-protocol packet counts that drive synthesis amplitudes.